CVE-2025-22228: Spring Security

High severity, CVSS 7.4. EPSS: 0.6% chance of exploitation in the next 30 days.

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Affected products

• Spring Spring Security: from 5.7, before 5.7.16 (fixed in 5.7.16); from 5.8, before 5.8.18 (fixed in 5.8.18); from 6.0, before 6.0.16 (fixed in 6.0.16); from 6.1, before 6.1.14 (fixed in 6.1.14); from 6.2, before 6.2.10 (fixed in 6.2.10); from 6.3, before 6.3.8 (fixed in 6.3.8); …

Published 2025-03-20. Last modified 2026-06-17.