HIGH7.4
GHSA-mg83-c7gq-rv5c
Spring Security Does Not Enforce Password Length
Quick fix
GHSA-mg83-c7gq-rv5c — org.springframework.security:spring-security-crypto: upgrade to the fixed version with the command below.
# pom.xml: bump <version>6.3.8</version> for org.springframework.security:spring-security-cryptoDetails
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.springframework.security:spring-security-crypto
Introduced in:
6.3.0Fixed in: 6.3.8Fix
# pom.xml: bump <version>6.3.8</version> for org.springframework.security:spring-security-cryptoMaven/org.springframework.security:spring-security-crypto
Introduced in:
6.4.0Fixed in: 6.4.4Fix
# pom.xml: bump <version>6.4.4</version> for org.springframework.security:spring-security-cryptoMaven/org.springframework.security:spring-security-crypto
Introduced in:
6.2.0Fixed in: 6.2.10Fix
# pom.xml: bump <version>6.2.10</version> for org.springframework.security:spring-security-cryptoMaven/org.springframework.security:spring-security-crypto
Introduced in:
6.1.0Fixed in: 6.1.14Fix
# pom.xml: bump <version>6.1.14</version> for org.springframework.security:spring-security-cryptoMaven/org.springframework.security:spring-security-crypto
Introduced in:
6.0.0Fixed in: 6.0.16Fix
# pom.xml: bump <version>6.0.16</version> for org.springframework.security:spring-security-cryptoMaven/org.springframework.security:spring-security-crypto
Introduced in:
5.8.0Fixed in: 5.8.18Fix
# pom.xml: bump <version>5.8.18</version> for org.springframework.security:spring-security-cryptoMaven/org.springframework.security:spring-security-crypto
Introduced in:
0Fixed in: 5.7.16Fix
# pom.xml: bump <version>5.7.16</version> for org.springframework.security:spring-security-cryptoReferences
- https://nvd.nist.gov/vuln/detail/CVE-2025-22228[ADVISORY]
- https://github.com/spring-projects/spring-security/commit/46f0dc6dfc8402cd556c598fdf2d31f9d46cdbf3[WEB]
- https://github.com/spring-projects/spring-security[PACKAGE]
- https://security.netapp.com/advisory/ntap-20250425-0009[WEB]
- https://spring.io/security/cve-2025-22228[WEB]