CVE-2025-22228 Security Details

CVE ID

CVE-2025-22228

CWE

CWE-287

CVE Description

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Published

Mar 20, 2025

CVSS Score & Severity

9.1Critical

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.065%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/security/crypto/bcrypt/BCrypt.hashpw([BLjava/lang/String;Z)Ljava/lang/String;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · CommitPROJECT

spring.ioPROJECT

GitHub · Advisory · GHSA-mg83-c7gq-rv5cTHIRD_PARTY

security.netapp.comTHIRD_PARTY