CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-22228: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length
7.4
CVSS
Description
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
Classification
CVE ID: CVE-2025-22228
CVSS Base Severity: HIGH
CVSS Base Score: 7.4
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
Vendor: Spring
Product: Spring Security
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 13.1% (scored less or equal to compared to others)
EPSS Date: 2025-04-18 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-22228https://spring.io/security/cve-2025-22228