{"id":"CVE-2025-22234","aliases":["CLSA-2025-1754525015","CLSA-2026-1774570925","CLSA-2026-1774570926","CLSA-2026-1774570928","CLSA-2026-1775435426","CLSA-2026-1775694712","CLSA-2026-1776126833","CLSA-2026-1789583743","EUVD-2026-3787","GHSA-vqxh-445g-37fc"],"status":"published","title":"Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation","description":"The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0039,"percentile":0.33609,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-208"],"published":"2026-01-22T21:02:23Z","modified":"2026-11-02T19:46:17Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.security:spring-security-core","fixed_in":["6.3.9","6.4.5"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","fixed_in":["5.8.16.tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","fixed_in":["5.8.16.tuxcare.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.8"},{"last_affected":"6.3.8"},{"fixed":"6.3.9"}]}],"versions":["6.3.8"]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.4"},{"last_affected":"6.4.4"},{"fixed":"6.4.5"}]}],"versions":["6.4.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.16"},{"fixed":"5.8.16.tuxcare.3"}]}],"versions":["5.8.16","5.8.16.tuxcare","5.8.16.tuxcare.1","5.8.16.tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.16"},{"fixed":"5.8.16.tuxcare.3"}]}],"versions":["5.8.16","5.8.16.tuxcare","5.8.16.tuxcare.1","5.8.16.tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.12"},{"fixed":"5.7.12-tuxcare.2"}]}],"versions":["5.7.12","5.7.12-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.12"},{"fixed":"5.7.12-tuxcare.2"}]}],"versions":["5.7.12","5.7.12-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.3"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.3"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.11"},{"fixed":"5.7.11-tuxcare.1"}]}],"versions":["5.7.11","5.7.11.tuxcare"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.11"},{"fixed":"5.7.11-tuxcare.1"}]}],"versions":["5.7.11","5.7.11.tuxcare"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.11"},{"fixed":"5.7.11-tuxcare.1"}]}],"versions":["5.7.11","5.7.11.tuxcare"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.2"},{"fixed":"6.2.2-tuxcare.1"}]}],"versions":["6.2.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.2"},{"fixed":"6.2.2-tuxcare.1"}]}],"versions":["6.2.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.2"},{"fixed":"6.2.2-tuxcare.1"}]}],"versions":["6.2.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.1"}]}],"versions":["6.4.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.1"}]}],"versions":["6.4.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.1"}]}],"versions":["6.4.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.1"}]}],"versions":["6.4.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.1"}]}],"versions":["5.6.10"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.1"}]}],"versions":["5.6.10"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.1"}]}],"versions":["5.6.10"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.20.RELEASE"},{"fixed":"4.2.20.RELEASE-tuxcare.7"}]}],"versions":["4.2.20.RELEASE","4.2.20.RELEASE-tuxcare.1","4.2.20.RELEASE-tuxcare.2","4.2.20.RELEASE-tuxcare.3","4.2.20.RELEASE-tuxcare.4","4.2.20.RELEASE-tuxcare.5","4.2.20.RELEASE-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.20.RELEASE"},{"fixed":"4.2.20.RELEASE-tuxcare.7"}]}],"versions":["4.2.20.RELEASE","4.2.20.RELEASE-tuxcare.1","4.2.20.RELEASE-tuxcare.2","4.2.20.RELEASE-tuxcare.3","4.2.20.RELEASE-tuxcare.4","4.2.20.RELEASE-tuxcare.5","4.2.20.RELEASE-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.20.RELEASE"},{"fixed":"4.2.20.RELEASE-tuxcare.7"}]}],"versions":["4.2.20.RELEASE","4.2.20.RELEASE-tuxcare.1","4.2.20.RELEASE-tuxcare.2","4.2.20.RELEASE-tuxcare.3","4.2.20.RELEASE-tuxcare.4","4.2.20.RELEASE-tuxcare.5","4.2.20.RELEASE-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.8"},{"fixed":"6.3.9"}]}],"versions":["6.3.8"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.4"},{"fixed":"6.4.5"}]}],"versions":["6.4.4"]}],"products":[{"vendor":"spring","product":"spring security"}],"references":[{"url":"https://spring.io/security/cve-2025-22234/","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22234","tags":["advisory"]},{"url":"https://spring.io/security/cve-2025-22234","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vqxh-445g-37fc"},{"url":"https://github.com/spring-projects/spring-security","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-22234","title":"Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation","description":"The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.","status":"published","published":"2026-01-22T21:02:23.992Z","modified":"2026-01-22T21:27:13.558Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:32:28.943062Z"}],"euvd":[{"id":"EUVD-2026-3787","description":"The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.","status":"published","published":"2026-01-22T21:02:23Z","modified":"2026-01-22T21:27:13Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:48.575559Z"}],"ghsa":[{"id":"GHSA-vqxh-445g-37fc","title":"Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide","description":"The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.","status":"published","published":"2026-01-22T21:33:47Z","modified":"2026-01-22T22:33:23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:39:19.525691Z"}],"nvd":[{"id":"CVE-2025-22234","description":"The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.","status":"published","published":"2026-01-22T21:15:49.42Z","modified":"2026-06-17T08:45:47.98Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:11:59.073638Z"}],"osv":[{"id":"GHSA-vqxh-445g-37fc","title":"Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide","description":"The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.","status":"published","published":"2026-01-22T21:33:47Z","modified":"2026-02-03T03:12:29.099699Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"CLSA-2025-1754525015","title":"TuxCare security update for org.springframework.security (1 CVE)","description":"TuxCare rebuilt 2 org.springframework.security packages to address 1 CVE. Fixed in 5.8.16.tuxcare.3.","status":"published","published":"2026-08-04T14:52:04Z","modified":"2026-11-02T19:45:09.34818251Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1774570925","title":"TuxCare security update for org.springframework.security (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 5.7.12-tuxcare.2.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-11-02T19:45:18.3040456Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1774570926","title":"TuxCare security update for org.springframework.security (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 6.1.6-tuxcare.3.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-11-02T19:45:18.291849348Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1774570928","title":"TuxCare security update for org.springframework.security (5 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 5 CVEs. Fixed in 5.7.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-11-02T19:45:18.297614566Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1775435426","title":"TuxCare security update for org.springframework.security (6 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 6 CVEs. Fixed in 6.2.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-11-02T19:45:23.579663687Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1775694712","title":"TuxCare security update for org.springframework.security (5 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 5 CVEs. Fixed in 6.4.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-11-02T19:45:20.39156813Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1776126833","title":"TuxCare security update for org.springframework.security (5 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 5 CVEs. Fixed in 5.6.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:25Z","modified":"2026-11-02T19:45:21.892295803Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1789583743","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 4.2.20.RELEASE-tuxcare.7.","status":"published","published":"2026-09-16T18:35:43Z","modified":"2026-11-02T19:46:17.779683241Z","updated_at":"2026-11-02T20:29:33.792105Z"}]}}