Spring Security BCryptPasswordEncoder does not enforce maximum password length

🗓️ 19 Mar 2025 00:00:00Reported by SpringType

spring🔗 spring.io👁 12 Views

BCryptPasswordEncoder does not enforce max password length; matches may succeed if the first 72 chars match.

Reporter	Title	Published	Views	Family All 101
IBM Security Bulletins	Security Bulletin: Vulnerabilities in old Spring Framework versions affect watsonx.data	13 Jun 202510:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.0.2	21 Jun 202513:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Broker Component vulnerable to BCryptPasswordEncoder will incorrectly return true for passwords larger than 72 characters.	28 Mar 202520:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability with spring-security-crypto and jinja affect IBM Cloud Object Storage Systems (July 2025)	1 Aug 202516:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions.	30 Jun 202523:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.10	29 Jul 202522:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in dependencies affect IBM Common Licensing	3 Sep 202504:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in Spring boot and Spring Security	24 Oct 202506:57	–	ibm
ATTACKERKB	CVE-2025-22228	20 Mar 202506:15	–	attackerkb
ATTACKERKB	CVE-2025-22234	22 Jan 202621:02	–	attackerkb