com.marcosbarbero.cloud:spring-cloud-zuul-ratelimit-core (>=1.7.3.release, <=1.7.4.release), net.acesinc:convergent-ui (1.1.2) +32 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.11.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: -...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +9830 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=5.0.1.release, <=5.7.14)

org.springframework.security:spring-security-crypto MAVEN version =5.0.1.release, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =0.5.0, =0.5.24 and more Source cves: CVE-2025-22228 Source advisory: GHSA-MG83-C7GQ-RV5C...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +9830 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=5.0.1.release, <=5.7.14)

org.springframework.security:spring-security-crypto MAVEN version =5.0.1.release, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =0.5.0, =0.5.24 and more Source cves: CVE-2025-22228 Source advisory: OSV:GHSA-MG83-C7GQ-RV5C...

cc.chensoul.nacos:nacos-distribution (2.5.2), cn.sparrowmini:sparrow-org-service (0.0.1) +756 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-crypto MAVEN version =5.8.0, =1.1.19, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2025-22228 Source advisory: OSV:GHSA-MG83-C7GQ-RV5Chttps://vulners.com/osvghsa/OSV:G...

be.jidoka:jdk-keycloak-admin (>=2.0.0, <=2.2.0), br.com.devires.framework.boot:devires-framework-boot-audit (1.1.0) +1737 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.0.0, <=6.0.8)

org.springframework.security:spring-security-crypto MAVEN version =6.0.0, =2.0.0, =1.1.0, =1.1.0, =0.12.0, =0.12.0, =0.12.0, =0.13.0, =3.0.1.0, =3.0.4.0 and more Source cves: CVE-2025-22228 Source advisory: OSV:GHSA-MG83-C7GQ-RV5C...

app.boboc:spring-cloud-github (>=0.0.2, <=3.1.12), be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.2.release) +2289 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.1.0, <=6.1.9)

org.springframework.security:spring-security-crypto MAVEN version =6.1.0, =0.0.2, =1.5.1.release, =2.1.0.release, =1.1.4.2, =0.15.0-rc1, =0.15.0-rc1, =0.15.0-rc1, =1.1.0, =1.1.2 and more Source cves: CVE-2025-22228 Source advisory: OSV:GHSA-MG83-C7GQ-RV5C...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +3211 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.2.0, <=6.2.8)

org.springframework.security:spring-security-crypto MAVEN version =6.2.0, =0.2.0, =0.0.1, =0.5.2, =0.5.0, =7.0.0, =1.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.31 and more Source cves: CVE-2025-22228 Source advisory: GHSA-MG83-C7GQ-RV5C...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +3211 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.2.0, <=6.2.8)

org.springframework.security:spring-security-crypto MAVEN version =6.2.0, =0.2.0, =0.0.1, =0.5.2, =0.5.0, =7.0.0, =1.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.31 and more Source cves: CVE-2025-22228 Source advisory: OSV:GHSA-MG83-C7GQ-RV5C...

net.tirasa.openjpasqlazure:openjpasqlazure (0.1.1), net.tirasa.openjpasqlazure:openjpasqlazure-core (0.1) +1 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.1.2.release)

org.springframework.security:spring-security-crypto MAVEN version 3.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - net.tirasa.openjpasqlazure:openjpasqlazure 0.1.1 ...

com.github.ptomli.bedrock:bedrock-core (1.0.0), com.mnubo:sdk-android (>=1.0.1, <=1.3.0) +9 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.1.3.release)

org.springframework.security:spring-security-crypto MAVEN version 3.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.github.ptomli.bedrock:bedrock-core 1.0.0 -...

ai.driftkit:driftkit-chat-assistant-framework (>=0.5.0, <=0.9.2), ai.driftkit:driftkit-clients-spring-ai-starter (>=0.6.0, <=0.9.2) +3027 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.3.0, <=6.3.7)

org.springframework.security:spring-security-crypto MAVEN version =6.3.0, =0.5.0, =0.6.0, =0.5.0, =0.8.4, =0.8.4, =0.9.1, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.9.2 and more Source cves: CVE-2025-22228 Source advisory:...

ai.driftkit:driftkit-chat-assistant-framework (>=0.5.0, <=0.9.2), ai.driftkit:driftkit-clients-spring-ai-starter (>=0.6.0, <=0.9.2) +3027 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.3.0, <=6.3.7)

org.springframework.security:spring-security-crypto MAVEN version =6.3.0, =0.5.0, =0.6.0, =0.5.0, =0.8.4, =0.8.4, =0.9.1, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.9.2 and more Source cves: CVE-2025-22228 Source advisory: GHSA-MG83-C7GQ-RV5C...

app.valuationcontrol:library (>=0.5.8, <=0.5.9), at.aimon.ops:aimon-ops-api (>=0.0.1, <=0.0.2) +2731 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.4.0, <=6.4.3)

org.springframework.security:spring-security-crypto MAVEN version =6.4.0, =0.5.8, =0.0.1, =0.0.1, =55.v51410e712e0c, =1.0.1, =1.0.2, =1.0.4, =1.0.2, =1.0.16, =1.0.2, =1.0.4, =2.3.0, =1.10.0, =1.10.0, =1.11.0 and more Source cves: CVE-2025-22228 Source advisory: GHSA-MG83-C7GQ-RV5C...

com.ctlok:spring-webmvc-rythm (>=1.3.6, <=1.4.2), com.daioware.security:security (1.0.0.release) +147 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.1.0.release)

org.springframework.security:spring-security-crypto MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.ctlok:spring-webmvc-rythm =1.3.6, =1.0.0,...

org.springframework.social:spring-social-facebook-web (>=1.0.2.release, <=1.0.3.release) potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.1.1.release)

org.springframework.security:spring-security-crypto MAVEN version 3.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: -...

app.valuationcontrol:library (>=0.5.8, <=0.5.9), at.aimon.ops:aimon-ops-api (>=0.0.1, <=0.0.2) +2731 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.4.0, <=6.4.3)

org.springframework.security:spring-security-crypto MAVEN version =6.4.0, =0.5.8, =0.0.1, =0.0.1, =55.v51410e712e0c, =1.0.1, =1.0.2, =1.0.4, =1.0.2, =1.0.16, =1.0.2, =1.0.4, =2.3.0, =1.10.0, =1.10.0, =1.11.0 and more Source cves: CVE-2025-22228 Source advisory: OSV:GHSA-MG83-C7GQ-RV5C...

ai.driftkit:driftkit-chat-assistant-framework (>=0.5.0, <=0.9.2), ai.driftkit:driftkit-clients-spring-ai-starter (>=0.6.0, <=0.9.2) +3027 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.3.0, <=6.3.7)

org.springframework.security:spring-security-crypto MAVEN version =6.3.0, =0.5.0, =0.6.0, =0.5.0, =0.8.4, =0.8.4, =0.9.1, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.9.2 and more Source cves: CVE-2025-22228 Source advisory: MEND:CVE-2025-22228...

app.valuationcontrol:library (>=0.5.8, <=0.5.9), at.aimon.ops:aimon-ops-api (>=0.0.1, <=0.0.2) +2731 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.4.0, <=6.4.3)

org.springframework.security:spring-security-crypto MAVEN version =6.4.0, =0.5.8, =0.0.1, =0.0.1, =55.v51410e712e0c, =1.0.1, =1.0.2, =1.0.4, =1.0.2, =1.0.16, =1.0.2, =1.0.4, =2.3.0, =1.10.0, =1.10.0, =1.11.0 and more Source cves: CVE-2025-22228 Source advisory: MEND:CVE-2025-22228...

Authentication Bypass by Primary Weakness

Overview org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the BCryptPasswordEncoder.matches function, which only takes the first 72 characte...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +5844 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.0.0, <=6.3.7)

org.springframework.security:spring-security-crypto MAVEN version =6.0.0, =0.2.0, =0.5.0, =0.6.0, =0.5.0, =0.8.4, =0.8.4, =0.9.1, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.9.2 and more Source cves: CVE-2025-22228 Source advisory:...