spring-projects/spring-security · Security
Spring Security Does Not Enforce Password Length
- GHSA ID
- GHSA-mg83-c7gq-rv5c
- CVE ID
- CVE-2025-22228
- Severity
- high
- Published
- Updated
- CVSS
- 7.4 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS v3
- 7.4 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
CWEs
- CWE-287 · Improper Authentication
- CWE-521 · Weak Password Requirements
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-22228 ↗
- https://spring.io/security/cve-2025-22228 ↗
- https://github.com/spring-projects/spring-security/commit/46f0dc6dfc8402cd556c598fdf2d31f9d46cdbf3 ↗
- https://security.netapp.com/advisory/ntap-20250425-0009 ↗
- https://github.com/advisories/GHSA-mg83-c7gq-rv5c ↗