CVE-2025-22228

CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length

7.4 HighFix available

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.61%Up 0.6 points since Mar 20, 2025

What each source reports

CVE List Score used 7.4

CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Record: CVE-2025-22228
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

EUVDEUVD-2025-6744 7.4

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Record: EUVD-2025-6744
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mg83-c7gq-rv5c 7.4

Spring Security Does Not Enforce Password Length

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Record: GHSA-mg83-c7gq-rv5c
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287, CWE-521
Updated: 2026-11-02

NVD 7.4

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Record: CVE-2025-22228
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSVGHSA-mg83-c7gq-rv5c 7.4

Spring Security Does Not Enforce Password Length

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Record: GHSA-mg83-c7gq-rv5c
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287, CWE-521
Updated: 2026-11-02

OSVRHSA-2025:10092 7.5

Red Hat Security Advisory: Red Hat Product OCP Tools 4.18 OpenShift Jenkins security update

Record: RHSA-2025:10092
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 27 moreShow less

OSVRHSA-2025:10097 7.5

Red Hat Security Advisory: Red Hat Product OCP Tools 4.17 OpenShift Jenkins security update

Record: RHSA-2025:10097
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2025:10098 7.5

Red Hat Security Advisory: Red Hat Product OCP Tools 4.16 OpenShift Jenkins security update

Record: RHSA-2025:10098
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2025:10104 7.5

Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update

Record: RHSA-2025:10104
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2025:10118 7.5

Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update

Record: RHSA-2025:10118
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2025:10119 7.5

Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update

Record: RHSA-2025:10119
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2025:10120 7.5

Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update

Record: RHSA-2025:10120
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2025-22228 7.4

CVE-2025-22228 in org.springframework.security:spring-security-crypto - Patched by Root

Root has patched CVE-2025-22228 in the org.springframework.security:spring-security-crypto package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2025-22228
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVCLSA-2025-1742947247 No score

TuxCare security update for org.springframework.security:spring-security-crypto (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-crypto to address 1 CVE. Fixed in 5.8.16.tuxcare.

Record: CLSA-2025-1742947247
Updated: 2026-11-02

OSVCLSA-2026-1773015254 No score

TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 5 CVEs. Fixed in 4.2.20.RELEASE-tuxcare.1.

Record: CLSA-2026-1773015254
Updated: 2026-11-02

OSVCLSA-2026-1774398059 No score

TuxCare security update for org.springframework.security (2 CVEs)

TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 5.7.14-tuxcare.1.

Record: CLSA-2026-1774398059
Updated: 2026-11-02

OSVCLSA-2026-1774570925 No score

TuxCare security update for org.springframework.security (2 CVEs)

TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 5.7.12-tuxcare.2.

Record: CLSA-2026-1774570925
Updated: 2026-11-02

OSVCLSA-2026-1774570926 No score

TuxCare security update for org.springframework.security (2 CVEs)

TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 6.1.6-tuxcare.3.

Record: CLSA-2026-1774570926
Updated: 2026-11-02

OSVCLSA-2026-1774570928 No score

TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 5 CVEs. Fixed in 5.7.11-tuxcare.1.

Record: CLSA-2026-1774570928
Updated: 2026-11-02

OSVCLSA-2026-1775435426 No score

TuxCare security update for org.springframework.security (6 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 6 CVEs. Fixed in 6.2.2-tuxcare.1.

Record: CLSA-2026-1775435426
Updated: 2026-11-02

OSVCLSA-2026-1775694712 No score

TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 5 CVEs. Fixed in 6.4.3-tuxcare.1.

Record: CLSA-2026-1775694712
Updated: 2026-11-02

OSVCLSA-2026-1775694713 No score

TuxCare security update for org.springframework.security (6 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 4.2.12.RELEASE-tuxcare.1.

Record: CLSA-2026-1775694713
Updated: 2026-11-02

OSVCLSA-2026-1776126833 No score

TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 5 CVEs. Fixed in 5.6.10-tuxcare.1.

Record: CLSA-2026-1776126833
Updated: 2026-11-02

OSVCLSA-2026-1785814692 No score

TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.0.8-tuxcare.1.

Record: CLSA-2026-1785814692
Updated: 2026-11-02

OSVCLSA-2026-1785814912 No score

TuxCare security update for org.springframework.security (2 CVEs)

TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 6.2.8-tuxcare.1.

Record: CLSA-2026-1785814912
Updated: 2026-11-02

OSVCLSA-2026-1785814923 No score

TuxCare security update for org.springframework.security (2 CVEs)

TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 6.2.7-tuxcare.1.

Record: CLSA-2026-1785814923
Updated: 2026-11-02

OSVCLSA-2026-1791380003 No score

TuxCare security update for org.springframework.security (11 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.7.7-tuxcare.1.

Record: CLSA-2026-1791380003
Updated: 2026-11-02

OSVCLSA-2026-1791391633 No score

TuxCare security update for org.springframework.security (11 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.5.8-tuxcare.1.

Record: CLSA-2026-1791391633
Updated: 2026-11-02

OSVCLSA-2026-1791392813 No score

TuxCare security update for org.springframework.security (10 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.9-tuxcare.1.

Record: CLSA-2026-1791392813
Updated: 2026-11-02

OSVCLSA-2026-1792079446 No score

TuxCare security update for org.springframework.security (15 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.

Record: CLSA-2026-1792079446
Updated: 2026-11-02

OSVCLSA-2026-1792089227 No score

TuxCare security update for org.springframework.security (10 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.7-tuxcare.1.

Record: CLSA-2026-1792089227
Updated: 2026-11-02

OSVCLSA-2026-1792588191 No score

TuxCare security update for org.springframework.security (9 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 3.2.8.RELEASE-tuxcare.1.

Record: CLSA-2026-1792588191
Updated: 2026-11-02

OSVRHLW-2026-351d5430e078d751 No score

Lightwell Security Advisory: spring-security-crypto 5.7.11.rhlw-00006

Red Hat Lightwell has released org.springframework.security:spring-security-crypto 5.7.11.rhlw-00006 with a backported security fix.

This patched artifact is a drop-in replacement for org.springframework.security:spring-security-crypto 5.7.11 from Maven Central.

Record: RHLW-2026-351d5430e078d751
Updated: 2026-11-02

Affected products

spring security

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework.security:spring-security-crypto` Maven	6.3.0 up to 6.3.8	6.3.8
`org.springframework.security:spring-security-crypto` Maven	6.4.0 up to 6.4.4	6.4.4
`org.springframework.security:spring-security-crypto` Maven	6.2.0 to 6.2.9	6.2.10
`org.springframework.security:spring-security-crypto` Maven	6.1.0 to 6.1.13	6.1.14
`org.springframework.security:spring-security-crypto` Maven	6.0.0 to 6.0.15	6.0.16
`org.springframework.security:spring-security-crypto` Maven	5.8.0 to 5.8.17	5.8.18
`org.springframework.security:spring-security-crypto` Maven	through 5.7.15	5.7.16
`org.springframework.security:spring-security-crypto` TuxCare:Maven	5.8.16 up to 5.8.16.tuxcare	5.8.16.tuxcare
`org.springframework.security:spring-security-bom` TuxCare:Maven From an advisory covering 5 CVEs	4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1	4.2.20.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 5 CVEs	4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1	4.2.20.RELEASE-tuxcare.1

Show 84 moreShow less

Affected packages
Package	Affected	Fixed
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 5 CVEs	4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1	4.2.20.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 5 CVEs	4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1	4.2.20.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 2 CVEs	5.7.14 up to 5.7.14-tuxcare.1	5.7.14-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 2 CVEs	5.7.14 up to 5.7.14-tuxcare.1	5.7.14-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 2 CVEs	5.7.12 up to 5.7.12-tuxcare.2, plus listed versions 5.7.12-tuxcare.1	5.7.12-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 2 CVEs	5.7.12 up to 5.7.12-tuxcare.2, plus listed versions 5.7.12-tuxcare.1	5.7.12-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 2 CVEs	6.1.6 up to 6.1.6-tuxcare.3, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.2	6.1.6-tuxcare.3
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 2 CVEs	6.1.6 up to 6.1.6-tuxcare.3, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.2	6.1.6-tuxcare.3
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 5 CVEs	5.7.11 up to 5.7.11-tuxcare.1, plus listed versions 5.7.11.tuxcare	5.7.11-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 6 CVEs	6.2.2 up to 6.2.2-tuxcare.1	6.2.2-tuxcare.1
`org.springframework.security:spring-security-config` TuxCare:Maven From an advisory covering 5 CVEs	6.4.3 up to 6.4.3-tuxcare.1	6.4.3-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 5 CVEs	6.4.3 up to 6.4.3-tuxcare.1	6.4.3-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 5 CVEs	6.4.3 up to 6.4.3-tuxcare.1	6.4.3-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 5 CVEs	6.4.3 up to 6.4.3-tuxcare.1	6.4.3-tuxcare.1
`org.springframework.security:spring-security-bom` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-cas` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 6 CVEs	4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1	4.2.12.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 5 CVEs	5.6.10 up to 5.6.10-tuxcare.1	5.6.10-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 3 CVEs	6.0.8 up to 6.0.8-tuxcare.1	6.0.8-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 3 CVEs	6.0.8 up to 6.0.8-tuxcare.1	6.0.8-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 3 CVEs	6.0.8 up to 6.0.8-tuxcare.1	6.0.8-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 2 CVEs	6.2.8 up to 6.2.8-tuxcare.1	6.2.8-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 2 CVEs	6.2.8 up to 6.2.8-tuxcare.1	6.2.8-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 2 CVEs	6.2.7 up to 6.2.7-tuxcare.1	6.2.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 2 CVEs	6.2.7 up to 6.2.7-tuxcare.1	6.2.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 11 CVEs	5.7.7 up to 5.7.7-tuxcare.1	5.7.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 11 CVEs	5.5.8 up to 5.5.8-tuxcare.1	5.5.8-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 10 CVEs	5.6.9 up to 5.6.9-tuxcare.1	5.6.9-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-bom` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-cas` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 9 CVEs	3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1	3.2.8.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` Maven	6.3.0 up to 6.3.8, plus listed versions 6.3.16.3.26.3.36.3.46.3.56.3.66.3.7	6.3.8
`org.springframework.security:spring-security-crypto` Maven	6.4.0 up to 6.4.4, plus listed versions 6.4.16.4.26.4.3	6.4.4
`org.springframework.security:spring-security-crypto` Maven	6.2.0 up to 6.2.10, plus listed versions 6.2.16.2.26.2.36.2.46.2.56.2.66.2.76.2.8	6.2.10
`org.springframework.security:spring-security-crypto` Maven	6.1.0 up to 6.1.14, plus listed versions 6.1.16.1.26.1.36.1.46.1.5 Show 4 moreShow less 6.1.66.1.76.1.86.1.9	6.1.14
`org.springframework.security:spring-security-crypto` Maven	6.0.0 up to 6.0.16, plus listed versions 6.0.16.0.26.0.36.0.46.0.56.0.66.0.76.0.8	6.0.16
`org.springframework.security:spring-security-crypto` Maven	5.8.0 up to 5.8.18, plus listed versions 5.8.15.8.105.8.115.8.125.8.13 Show 11 moreShow less 5.8.145.8.155.8.165.8.25.8.35.8.45.8.55.8.65.8.75.8.85.8.9	5.8.18
`org.springframework.security:spring-security-crypto` Maven	before 5.7.16, plus listed versions 3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE Show 45 moreShow less 3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE4.2.10.RELEASE4.2.11.RELEASE4.2.12.RELEASE4.2.13.RELEASE4.2.14.RELEASE4.2.15.RELEASE4.2.16.RELEASE4.2.17.RELEASE4.2.18.RELEASE4.2.19.RELEASE4.2.2.RELEASE4.2.20.RELEASE4.2.3.RELEASE4.2.4.RELEASE4.2.5.RELEASE4.2.6.RELEASE4.2.7.RELEASE4.2.8.RELEASE	5.7.16
`org.springframework.security:spring-security-crypto` Red Hat Lightwell:Maven	before 5.7.11.rhlw-00006, plus listed versions 3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE Show 45 moreShow less 3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE4.2.10.RELEASE4.2.11.RELEASE4.2.12.RELEASE4.2.13.RELEASE4.2.14.RELEASE4.2.15.RELEASE4.2.16.RELEASE4.2.17.RELEASE4.2.18.RELEASE4.2.19.RELEASE4.2.2.RELEASE4.2.20.RELEASE4.2.3.RELEASE4.2.4.RELEASE4.2.5.RELEASE4.2.6.RELEASE4.2.7.RELEASE4.2.8.RELEASE	5.7.11.rhlw-00006
`jenkins` Red Hat:ocp_tools:4.18::el9 From an advisory covering 4 CVEs	before 0:2.504.2.1750846524-3.el9	0:2.504.2.1750846524-3.el9
`jenkins-2-plugins` Red Hat:ocp_tools:4.18::el9 From an advisory covering 4 CVEs	before 0:4.18.1750846854-1.el9	0:4.18.1750846854-1.el9
`jenkins` Red Hat:ocp_tools:4.17::el9 From an advisory covering 4 CVEs	before 0:2.504.2.1750851690-3.el9	0:2.504.2.1750851690-3.el9
`jenkins-2-plugins` Red Hat:ocp_tools:4.17::el9 From an advisory covering 4 CVEs	before 0:4.17.1750851950-1.el9	0:4.17.1750851950-1.el9
`jenkins` Red Hat:ocp_tools:4.16::el9 From an advisory covering 4 CVEs	before 0:2.504.2.1750857144-3.el9	0:2.504.2.1750857144-3.el9
`jenkins-2-plugins` Red Hat:ocp_tools:4.16::el9 From an advisory covering 4 CVEs	before 0:4.16.1750857315-1.el9	0:4.16.1750857315-1.el9
`jenkins` Red Hat:ocp_tools:4.15::el8 From an advisory covering 4 CVEs	before 0:2.504.2.1750856366-3.el8	0:2.504.2.1750856366-3.el8
`jenkins-2-plugins` Red Hat:ocp_tools:4.15::el8 From an advisory covering 4 CVEs	before 0:4.15.1750856638-1.el8	0:4.15.1750856638-1.el8
`jenkins` Red Hat:ocp_tools:4.12::el8 From an advisory covering 4 CVEs	before 0:2.504.2.1750932984-3.el8	0:2.504.2.1750932984-3.el8
`jenkins-2-plugins` Red Hat:ocp_tools:4.12::el8 From an advisory covering 4 CVEs	before 0:4.12.1750933270-1.el8	0:4.12.1750933270-1.el8
`jenkins` Red Hat:ocp_tools:4.13::el8 From an advisory covering 4 CVEs	before 0:2.504.2.1750916374-3.el8	0:2.504.2.1750916374-3.el8
`jenkins-2-plugins` Red Hat:ocp_tools:4.13::el8 From an advisory covering 4 CVEs	before 0:4.13.1750916671-1.el8	0:4.13.1750916671-1.el8
`jenkins` Red Hat:ocp_tools:4.14::el8 From an advisory covering 4 CVEs	before 0:2.504.2.1750903189-3.el8	0:2.504.2.1750903189-3.el8
`jenkins-2-plugins` Red Hat:ocp_tools:4.14::el8 From an advisory covering 4 CVEs	before 0:4.14.1750903529-1.el8	0:4.14.1750903529-1.el8
`org.springframework.security:spring-security-crypto` Root:Maven	before 6.4.2-aikido.2	6.4.2-aikido.26.1.3-aikido.56.2.0-aikido.26.3.3-aikido.25.7.5-aikido.16.2.0-aikido.36.2.0-aikido.46.1.3-aikido.66.1.3-aikido.76.2.0-aikido.5
`io.root.org.springframework.security:spring-security-crypto` Root:Maven	before 6.1.3-root.io.1	6.1.3-root.io.16.1.3-root.io.26.1.3-root.io.36.1.3-root.io.46.2.0-root.io.16.3.3-root.io.16.4.2-root.io.25.7.1-root.io.26.1.3-root.io.56.2.0-root.io.26.3.3-root.io.25.7.5-root.io.16.2.0-root.io.36.2.0-root.io.46.1.3-root.io.66.1.3-root.io.76.2.0-root.io.5

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-22228 is a high vulnerability (CVSS 7.4) in Spring Security, published March 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in org.springframework.security:spring-security-crypto 6.3.8.

References

Show 36 moreShow less

This page doesn't list everything

Left out here: 225 versions. The JSON record has them.