Vulnerability · Published Jan 22, 2026 · Assigned by vmware
CVE-2025-22234Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation
Medium 5.3
In plain English
A medium-severity security flaw in Spring Security from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 66.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | 6.3.9 | GHSA-vqxh-445g-37fc |
| Maven | org.springframework.security:spring-security-core | 6.4.5 | GHSA-vqxh-445g-37fc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Security | 5.7.165.8.186.0.166.1.146.2.106.3.86.4.4 |
Weakness: CWE-208 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- Spring Security Advisory: CVE-2025-22234 vendor-advisory