cn.springcloud.gray:spring-cloud-bamboo (>=1.0.0, <=1.0.2), cn.springcloud.gray:spring-cloud-gray-client (>=a.1.0.1, <=1.0.2) +870 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.3.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - cn.springcloud.gray:spring-cloud-bamboo =1.0.0,...

com.ahome-it:ahome-tooling-server-core (>=1.1.0-release, <=1.1.3-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.0-release, <=1.1.3-release) +3 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.1.0.release)

org.springframework.security:spring-security-crypto MAVEN version 4.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.ahome-it:ahome-tooling-server-core...

com.alibaba.cloud:spring-cloud-alibaba-nacos-config (1.5.0.release), com.alibaba.cloud:spring-cloud-alibaba-nacos-discovery (1.5.0.release) +145 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.8.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.alibaba.cloud:spring-cloud-alibaba-nacos-conf...

com.github.chenhaiyangs:ruubypay-configx-core (>=1.0.0, <=1.3.0), com.github.jmnarloch:feign-encoding-spring-cloud-starter (>=1.0.0, <=1.1.1) +51 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.2.7.release)

org.springframework.security:spring-security-crypto MAVEN version 3.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.github.chenhaiyangs:ruubypay-configx-core...

com.ahome-it:ahome-tooling-server-core (>=1.1.5-release, <=1.1.9-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.5-release, <=1.1.9-release) +17 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.1.2.release)

org.springframework.security:spring-security-crypto MAVEN version 4.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.ahome-it:ahome-tooling-server-core...

com.apigee.edge.config:apigee-config-maven-plugin (>=1.3, <=2.2.2), com.nepxion:permission-aop (2.0.8) +10 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.9.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.apigee.edge.config:apigee-config-maven-plugin...

be.jidoka:jdk-keycloak-admin (>=2.0.0, <=2.2.0), br.com.devires.framework.boot:devires-framework-boot-audit (1.1.0) +1737 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.0.0, <=6.0.8)

org.springframework.security:spring-security-crypto MAVEN version =6.0.0, =2.0.0, =1.1.0, =1.1.0, =0.12.0, =0.12.0, =0.12.0, =0.13.0, =3.0.1.0, =3.0.4.0 and more Source cves: CVE-2025-22228 Source advisory: OSV:GHSA-MG83-C7GQ-RV5C...

com.ixortalk:ixortalk-image-service (>=0.0.1, <=0.0.8), com.nepxion:discovery-console (>=edgware.1.0.0, <=3.14.0) +38 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.10.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.ixortalk:ixortalk-image-service =0.0.1,...

com.alibaba.cloud:spring-cloud-alibaba-nacos-config (1.5.1.release), com.alibaba.cloud:spring-cloud-alibaba-nacos-discovery (1.5.1.release) +129 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.12.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: -...

cc.chensoul.nacos:nacos-distribution (2.5.2), cn.sparrowmini:sparrow-org-service (0.0.1) +756 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-crypto MAVEN version =5.8.0, =1.1.19, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2025-22228 Source advisory: OSV:GHSA-MG83-C7GQ-RV5Chttps://vulners.com/osv/OSV:GHSA-M...

com.17jee:e-cloud-authorize (>=3.0.0, <=3.0.1.11), com.17jee:e-cloud-gateway (>=3.0.0, <=3.0.1.11) +365 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.0.4.release)

org.springframework.security:spring-security-crypto MAVEN version 4.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.17jee:e-cloud-authorize =3.0.0, =3.0.0, =3.0....

com.capitalone.dashboard:api (>=3.1.0, <=3.2.7), com.capitalone.dashboard:api-audit (>=3.1.0, <=3.3.9) +37 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.0.3.release)

org.springframework.security:spring-security-crypto MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.capitalone.dashboard:api =3.1.0, =3.1.0,...

net.gplatform:sudoor-server-lib (>=1.0.4, <=1.0.12), org.springframework.boot:spring-boot-starter-social-twitter (>=1.1.0.release, <=1.1.5.release) +1 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.2.4.release)

org.springframework.security:spring-security-crypto MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - net.gplatform:sudoor-server-lib =1.0.4,...

com.alibaba.edas:edas-sc-gray-autoconfigure (1.0.0), com.antheminc.oss:nimbus-core (>=1.1.7, <=1.2.0) +18 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.2.6.release)

org.springframework.security:spring-security-crypto MAVEN version 4.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.alibaba.edas:edas-sc-gray-autoconfigure 1.0.0...

com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.0.108-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.88-rc1, <=1.0.107-release) +9 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (4.0.1.release)

org.springframework.security:spring-security-crypto MAVEN version 4.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.0.83-rc...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +9812 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=5.0.1.release, <=5.7.14)

org.springframework.security:spring-security-crypto MAVEN version =5.0.1.release, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =4.4.0.2, =0.5.0, =0.5.24 and more Source cves: CVE-2025-22228 Source advisory: GHSA-MG83-C7GQ-RV5C...

ai.driftkit:driftkit-chat-assistant-framework (>=0.5.0, <=0.9.2), ai.driftkit:driftkit-clients-spring-ai-starter (>=0.6.0, <=0.9.2) +3025 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.3.0, <=6.3.7)

org.springframework.security:spring-security-crypto MAVEN version =6.3.0, =0.5.0, =0.6.0, =0.5.0, =0.8.4, =0.8.4, =0.9.1, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.9.2 and more Source cves: CVE-2025-22228 Source advisory: GHSA-MG83-C7GQ-RV5C...

app.valuationcontrol:library (>=0.5.8, <=0.5.9), at.aimon.ops:aimon-ops-api (>=0.0.1, <=0.0.2) +2731 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=6.4.0, <=6.4.3)

org.springframework.security:spring-security-crypto MAVEN version =6.4.0, =0.5.8, =0.0.1, =0.0.1, =55.v51410e712e0c, =1.0.1, =1.0.2, =1.0.4, =1.0.2, =1.0.16, =1.0.2, =1.0.4, =2.3.0, =1.10.0, =1.10.0, =1.11.0 and more Source cves: CVE-2025-22228 Source advisory: GHSA-MG83-C7GQ-RV5C...

Spring Security Does Not Enforce Password Length

BCryptPasswordEncoder.matchesCharSequence,String will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same...

cc.chensoul.nacos:nacos-distribution (2.5.2), cn.sparrowmini:sparrow-org-service (0.0.1) +756 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-crypto MAVEN version =5.8.0, =1.1.19, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2025-22228 Source advisory: GHSA-MG83-C7GQ-RV5Chttps://vulners.com/github/GHSA-MG83-C...