CVE-2025-22228

CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length

High · published March 20, 2025

CVSS v3.1
7.4
EPSS
1%
Percentile
48.5
In the wild
Unconfirmed
What it is

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00610 · 48.5th percentile
Published
2025-03-20T05:49Z
EPSS history
Timeline
  • 20 MAR 05:49Z
    CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length
    cvelistv5