Skip to content
Fencer Vulns
high 7.4

CVE-2025-22228 json

CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length

published 2025-03-20 19 mo ago modified 2026-09-10 1 mo ago also GHSA-mg83-c7gq-rv5c , EUVD-2025-6744

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits
0
none known

Summary

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Patch / fix

  • maven org.springframework.security:spring-security-crypto 5.7.16, 5.8.18, 6.0.16, 6.1.14, 6.2.10, 6.3.8, 6.4.4
  • Spring Spring Security 5.7.16, 5.8.18, 6.0.16, 6.1.14, 6.2.10, 6.3.8, 6.4.4
  • jenkins ocp tools 4.14 2.504.2.1750903189-3.el8
  • jenkins-2-plugins ocp tools 4.14 4.14.1750903529-1.el8
  • jenkins ocp tools 4.13 2.504.2.1750916374-3.el8
  • jenkins-2-plugins ocp tools 4.13 4.13.1750916671-1.el8
  • jenkins ocp tools 4.12 2.504.2.1750932984-3.el8
  • jenkins-2-plugins ocp tools 4.12 4.12.1750933270-1.el8
  • jenkins ocp tools 4.15 2.504.2.1750856366-3.el8
  • jenkins-2-plugins ocp tools 4.15 4.15.1750856638-1.el8

red hat advisories RHSA-2025:10120RHSA-2025:10119RHSA-2025:10118RHSA-2025:10104RHSA-2025:10098RHSA-2025:10097

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-22228 updated cvss 7.4

spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length

  • Red Hat A-MQ Clients 2 spring-security-core Red Hat Data Grid 8 spring-security-core Red Hat Fuse 7 spring-security-core, org.apache.servicemix.bundles.spring-security-core Red Hat Integration Camel K 1 spring-security-core Red Hat Process Automation 7 spring-security-core Red Hat streams for Apache Kafka spring-security-core
    affected: workaround, no fix planned “Red Hat Product Security does not have a recommended mitigation at this time.”
  • Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins 2.504.2.1750932984-3.el8, jenkins-2-plugins 4.12.1750933270-1.el8
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:10118
  • Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins 2.504.2.1750916374-3.el8, jenkins-2-plugins 4.13.1750916671-1.el8
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:10119
  • Red Hat OpenShift Developer Tools and Services for OCP 4.14 jenkins 2.504.2.1750903189-3.el8, jenkins-2-plugins 4.14.1750903529-1.el8
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:10120
  • Red Hat OpenShift Developer Tools and Services for OCP 4.15 jenkins 2.504.2.1750856366-3.el8, jenkins-2-plugins 4.15.1750856638-1.el8
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:10104
  • Red Hat OpenShift Developer Tools and Services for OCP 4.16 jenkins 2.504.2.1750857144-3.el9, jenkins-2-plugins 4.16.1750857315-1.el9
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:10098
  • Red Hat OpenShift Developer Tools and Services for OCP 4.17 jenkins 2.504.2.1750851690-3.el9, jenkins-2-plugins 4.17.1750851950-1.el9
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:10097
  • Red Hat OpenShift Developer Tools and Services for OCP 4.18 jenkins 2.504.2.1750846524-3.el9, jenkins-2-plugins 4.18.1750846854-1.el9
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:10092
show 4 more
  • Red Hat build of Apache Camel 4.8.5 for Spring Boot
    fixed: vendor fix “Red Hat Product Security does not have a recommended mitigation at this time.” RHSA-2025:3543
  • Red Hat build of Quarkus quarkus-bom
    not affected: component not present
  • Red Hat JBoss Enterprise Application Platform 7 spring-security-core Red Hat JBoss Enterprise Application Platform 8 spring-security-core Red Hat JBoss Enterprise Application Platform Expansion Pack spring-security-core
    not affected: vulnerable code not present
  • Red Hat Single Sign-On 7 spring-security-core
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
19 mo ago

Exploit prediction

0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.springframework.security:spring-security-crypto
>=6.3.0, <6.3.8
>=6.4.0, <6.4.4
>=6.2.0, <6.2.10
>=6.1.0, <6.1.14
>=6.0.0, <6.0.16
>=5.8.0, <5.8.18
<5.7.16
6.3.8
6.4.4
6.2.10
6.1.14
6.0.16
5.8.18
5.7.16

Affected products

  • Spring Spring Security

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.