CVE-2025-22228 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length

🗓️ 20 Mar 2025 05:49:19Reported by vmwareType

Spring Security BCryptPasswordEncoder lacks maximum password length enforcement, allowing false matches.

Reporter	Title	Published	Views	Family All 99
IBM Security Bulletins	Security Bulletin: Vulnerabilities in old Spring Framework versions affect watsonx.data	13 Jun 202510:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.0.2	21 Jun 202513:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Broker Component vulnerable to BCryptPasswordEncoder will incorrectly return true for passwords larger than 72 characters.	28 Mar 202520:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability with spring-security-crypto and jinja affect IBM Cloud Object Storage Systems (July 2025)	1 Aug 202516:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions.	30 Jun 202523:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.10	29 Jul 202522:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in dependencies affect IBM Common Licensing	3 Sep 202504:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in Spring boot and Spring Security	24 Oct 202506:57	–	ibm
ATTACKERKB	CVE-2025-22228	20 Mar 202506:15	–	attackerkb
ATTACKERKB	CVE-2025-22234	22 Jan 202621:02	–	attackerkb

[
  {
    "defaultStatus": "affected",
    "packageName": "Spring Security",
    "product": "Spring Security",
    "vendor": "Spring",
    "versions": [
      {
        "lessThan": "5.7.16",
        "status": "affected",
        "version": "5.7.x",
        "versionType": "Enterprise Support Only"
      },
      {
        "lessThan": "5.8.18",
        "status": "affected",
        "version": "5.8.x",
        "versionType": "Enterprise Support Only"
      },
      {
        "lessThan": "6.0.16",
        "status": "affected",
        "version": "6.0.x",
        "versionType": "Enterprise Support Only"
      },
      {
        "lessThan": "6.1.14",
        "status": "affected",
        "version": "6.1.x",
        "versionType": "Enterprise Support Only"
      },
      {
        "lessThan": "6.2.10",
        "status": "affected",
        "version": "6.2.x",
        "versionType": "Enterprise Support Only"
      },
      {
        "lessThan": "6.3.8",
        "status": "affected",
        "version": "6.3.x",
        "versionType": "OSS"
      },
      {
        "lessThan": "6.4.4",
        "status": "affected",
        "version": "6.4.x",
        "versionType": "OSS"
      }
    ]
  }
]

Source	Link
spring	www.spring.io/security/cve-2025-22228

20 Mar 2025 05:49Current

CVSS 3.17.4

EPSS0.00522