CVE-2025-22228
Spring Security Does Not Enforce Password Length
Summary
Spring Security Does Not Enforce Password Length
Original description
The description as published by the source.
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Maven
org.springframework.security:spring-security-crypto
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.16"}]}]
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web security.netapp.com
- web spring.io