ROOT-APP-MAVEN-CVE-2025-22228 CVE-2025-22228 in org.springframework.security:spring-security-crypto - Patched by Root

Root has patched CVE-2025-22228 in the org.springframework.security:spring-security-crypto package for Root:Maven. Multiple fixed versions available...

be.appify.prefab:prefab-security (>=0.2.0, <=0.10.9), br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0) +2518 more potentially affected by CVE-2026-47842 via org.springframework.security:spring-security-crypto (>=7.0.0, <=7.0.6)

org.springframework.security:spring-security-crypto MAVEN version =7.0.0, =0.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =5.0.0, =5.0.0, =5.0.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =8.0.0-alpha-springboot4, =8.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =4.0.0-alpha-springboot4,...

Generation of Predictable IV with CBC Mode

Overview org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security. Affected versions of this package are vulnerable to Generation of Predictable IV with CBC Mode via AesBytesEncryptor when using the two-argument constructor or specifying a null I...

ai.authplane.sdk:authplane-spring (>=0.1.0, <=0.3.0), ai.loomspan:loomspan-spring-boot-starter (>=1.0.0-beta.1, <=1.0.0-beta.8) +1895 more potentially affected by CVE-2026-47842 via org.springframework.security:spring-security-crypto (7.1.0)

org.springframework.security:spring-security-crypto MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - ai.authplane.sdk:authplane-spring =0.1.0, =1.0.0-beta.1,...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +12117 more potentially affected by CVE-2026-47842 via org.springframework.security:spring-security-crypto (>=5.7.0, <=7.0.6)

org.springframework.security:spring-security-crypto MAVEN version =5.7.0, =0.2.0, =0.5.0, =0.6.0, =0.5.0, =0.8.4, =0.8.4, =0.9.1, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.9.2 and more Source cves: CVE-2026-47842 Source advisory:...

com.almis.awe:awe-annotation (>=4.10.11, <=4.11.2), com.almis.awe:awe-annotations-spring-boot-starter (>=4.10.11, <=4.11.2) +152 more potentially affected by CVE-2025-22234 via org.springframework.security:spring-security-crypto (6.3.8)

org.springframework.security:spring-security-crypto MAVEN version 6.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.almis.awe:awe-annotation =4.10.11, =4.10.11, =4.10.11...

be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release), ch.admin.bit.jeap:jeap-archrepo-instance (>=1.12.0, <=1.14.0) +1682 more potentially affected by CVE-2025-22234 via org.springframework.security:spring-security-crypto (6.4.4)

org.springframework.security:spring-security-crypto MAVEN version 6.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - be.personify.iam:personify-frontend =1.5.4.release,...

Security Bulletin: Vulnerability with spring-security-crypto and jinja affect IBM Cloud Object Storage Systems (July 2025)

Summary Vulnerability with spring-security-crypto CVE-2025-22228 and jinja CVE-2025-27516 . This vulnerability has been addressed in the latest ClevOS release. Vulnerability Details CVEID:CVE-2025-22228 DESCRIPTION: BCryptPasswordEncoder.matchesCharSequence,String will incorrectly return true for...

Timing Attack

Overview org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security. Affected versions of this package are vulnerable to Timing Attack due to an unintentional bypass for DaoAuthenticationProvider constant time controls, which was caused by the fix...

com.almis.awe:awe-annotation (>=4.10.11, <=4.11.2), com.almis.awe:awe-annotations-spring-boot-starter (>=4.10.11, <=4.11.2) +152 more potentially affected by CVE-2025-22228 +1 more via org.springframework.security:spring-security-crypto (6.3.8)

org.springframework.security:spring-security-crypto MAVEN version 6.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.almis.awe:awe-annotation =4.10.11, =4.10.11, =4.10.11...

be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release), ch.admin.bit.jeap:jeap-archrepo-instance (>=1.12.0, <=1.14.0) +1682 more potentially affected by CVE-2025-22228 +1 more via org.springframework.security:spring-security-crypto (6.4.4)

org.springframework.security:spring-security-crypto MAVEN version 6.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - be.personify.iam:personify-frontend =1.5.4.release,...

net.gplatform:sudoor-server-lib (>=1.0.4, <=1.0.12), org.springframework.boot:spring-boot-starter-social-twitter (>=1.1.0.release, <=1.1.5.release) +1 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.2.4.release)

org.springframework.security:spring-security-crypto MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - net.gplatform:sudoor-server-lib =1.0.4,...

com.github.mihajul:spring-social-apple (1.0.0), com.sachinhandiekar:spring-social-live (>=1.0.3, <=1.0.4) +4 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.2.5.release)

org.springframework.security:spring-security-crypto MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.github.mihajul:spring-social-apple 1.0.0 -...

com.miserablemind:tradeking-api-consumer (1.0.0-alpha), de.codecentric:spring-boot-admin-sample-discovery (1.2.0) +19 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.2.6.release)

org.springframework.security:spring-security-crypto MAVEN version 3.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.miserablemind:tradeking-api-consumer...

com.github.chenhaiyangs:ruubypay-configx-core (>=1.0.0, <=1.3.0), com.github.jmnarloch:feign-encoding-spring-cloud-starter (>=1.0.0, <=1.1.1) +51 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.2.7.release)

org.springframework.security:spring-security-crypto MAVEN version 3.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.github.chenhaiyangs:ruubypay-configx-core...

com.transempiric:simple-encryptor (1.0.0), de.enterprise-starters:enterprise-application-spring-boot-starter (2.2.0-alpha) +37 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.2.8.release)

org.springframework.security:spring-security-crypto MAVEN version 3.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.transempiric:simple-encryptor 1.0.0 -...

cn.home1:oss-admin (>=1.0.6.oss, <=1.0.7.oss), cn.home1:oss-configserver (>=1.0.6.oss, <=1.0.7.oss) +264 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.1.3.release)

org.springframework.security:spring-security-crypto MAVEN version 4.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - cn.home1:oss-admin =1.0.6.oss, =1.0.6.oss,...

com.ahome-it:ahome-tooling-server-core (>=1.1.19-release, <=1.1.27-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.23-release, <=1.1.27-release) +4 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.0.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.ahome-it:ahome-tooling-server-core...

br.jus.stf.digital:core (>=2.0.0, <=2.3.1), br.jus.stf.digital:test (>=1.0.3, <=1.1.0) +502 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.2.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - br.jus.stf.digital:core =2.0.0, =1.0.3, =1.1.7,...

com.actionsky:txle-server (>=2.19.10.0, <=2.19.11.0), com.arcadeanalytics:arcadeanalytics (>=1.0.2, <=1.0.8) +172 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.7.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.actionsky:txle-server =2.19.10.0, =1.0.2,...