BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.springframework.security:spring-security-crypto(Maven) | 6.3.0 | 6.3.8 | N/A |
| org.springframework.security:spring-security-crypto(Maven) | 6.4.0 | 6.4.4 | N/A |
| org.springframework.security:spring-security-crypto(Maven) | 6.2.0 | 6.2.10 | N/A |
| org.springframework.security:spring-security-crypto(Maven) | 6.1.0 | 6.1.14 | N/A |
| org.springframework.security:spring-security-crypto(Maven) | 6.0.0 | 6.0.16 | N/A |
| org.springframework.security:spring-security-crypto(Maven) | 5.8.0 | 5.8.18 | N/A |
| org.springframework.security:spring-security-crypto(Maven) | 0 | 5.7.16 | N/A |
CVSS Metrics
