Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2025-22228

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

VectorNETWORK

PublishedMar 20, 2025, 06:15

Published Bysecurity@vmware.com

Base Score

Score7.4

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.springframework.security:spring-security-crypto(Maven)6.3.06.3.8N/A

org.springframework.security:spring-security-crypto(Maven)6.4.06.4.4N/A

org.springframework.security:spring-security-crypto(Maven)6.2.06.2.10N/A

org.springframework.security:spring-security-crypto(Maven)6.1.06.1.14N/A

org.springframework.security:spring-security-crypto(Maven)6.0.06.0.16N/A

org.springframework.security:spring-security-crypto(Maven)5.8.05.8.18N/A

org.springframework.security:spring-security-crypto(Maven)05.7.16N/A

References

Weakness Type

CWE-287

CVSS Metrics

Base Score

7.4

Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK