CVSS 3.1
7.4 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NCVE-2025-22228
High (7.4). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in org.springframework.security:spring-security-crypto 5.7.16, 5.8.18, 6.0.16.
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mg83-c7gq-rv5c | Maven | org.springframework.security:spring-security-crypto | >=6.3.0 <6.3.8 | 6.3.8 |
| GHSA-mg83-c7gq-rv5c | Maven | org.springframework.security:spring-security-crypto | >=6.4.0 <6.4.4 | 6.4.4 |
| GHSA-mg83-c7gq-rv5c | Maven | org.springframework.security:spring-security-crypto | >=6.2.0 <6.2.10 | 6.2.10 |
| GHSA-mg83-c7gq-rv5c | Maven | org.springframework.security:spring-security-crypto | >=6.1.0 <6.1.14 | 6.1.14 |
| GHSA-mg83-c7gq-rv5c | Maven | org.springframework.security:spring-security-crypto | >=6.0.0 <6.0.16 | 6.0.16 |
| GHSA-mg83-c7gq-rv5c | Maven | org.springframework.security:spring-security-crypto | >=5.8.0 <5.8.18 | 5.8.18 |
| GHSA-mg83-c7gq-rv5c | Maven | org.springframework.security:spring-security-crypto | <5.7.16 | 5.7.16 |