Read the docs
TI-2025-16139 Aliases CVE-2025-22228GHSA-mg83-c7gq-rv5c

CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length

Priority LOW 35CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 8 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0061 49th percentileScored 2026-11-07
Fix Partial Spring Security (Spring): 5.7.16, 5.8.18, 6.0.16 +4org.springframework.security:spring-security-crypto (Maven): 6.3.8, 6.4.4, 6.2.10 +4Red Hat: 8 advisoriesRed Hat: 8 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareSpring Security5.7.x to before 5.7.16; 5.8.x to before 5.8.18; 6.0.x to before 6.0.16; 6.1.x to before 6.1.14; 6.2.x to before 6.2.10; 6.3.x to before 6.3.8; 6.4.x to before 6.4.45.7.16, 5.8.18, 6.0.16, 6.1.14, 6.2.10, 6.3.8, 6.4.4Patch availableCNA
—org.springframework.security:spring-security-crypto (Maven)6.3.0 to before 6.3.86.3.8Patch availableGHSA-mg83-c7gq-rv5c
—org.springframework.security:spring-security-crypto (Maven)6.4.0 to before 6.4.46.4.4Patch availableGHSA-mg83-c7gq-rv5c
—org.springframework.security:spring-security-crypto (Maven)6.2.0 to before 6.2.106.2.10Patch availableGHSA-mg83-c7gq-rv5c
—org.springframework.security:spring-security-crypto (Maven)6.1.0 to before 6.1.146.1.14Patch availableGHSA-mg83-c7gq-rv5c
—org.springframework.security:spring-security-crypto (Maven)6.0.0 to before 6.0.166.0.16Patch availableGHSA-mg83-c7gq-rv5c
—org.springframework.security:spring-security-crypto (Maven)5.8.0 to before 5.8.185.8.18Patch availableGHSA-mg83-c7gq-rv5c
—org.springframework.security:spring-security-crypto (Maven)before 5.7.165.7.16Patch availableGHSA-mg83-c7gq-rv5c
  • Spring Security VendorVMware Affected 5.7.x to before 5.7.16; 5.8.x to before 5.8.18; 6.0.x to before 6.0.16; 6.1.x to before 6.1.14; 6.2.x to before 6.2.10; 6.3.x to before 6.3.8; 6.4.x to before 6.4.4 Fixed in 5.7.16, 5.8.18, 6.0.16, 6.1.14, 6.2.10, 6.3.8, 6.4.4 Patch available CNA
  • org.springframework.security:spring-security-crypto (Maven) Vendor— Affected 6.3.0 to before 6.3.8 Fixed in 6.3.8 Patch available GHSA-mg83-c7gq-rv5c
  • org.springframework.security:spring-security-crypto (Maven) Vendor— Affected 6.4.0 to before 6.4.4 Fixed in 6.4.4 Patch available GHSA-mg83-c7gq-rv5c
  • org.springframework.security:spring-security-crypto (Maven) Vendor— Affected 6.2.0 to before 6.2.10 Fixed in 6.2.10 Patch available GHSA-mg83-c7gq-rv5c
  • org.springframework.security:spring-security-crypto (Maven) Vendor— Affected 6.1.0 to before 6.1.14 Fixed in 6.1.14 Patch available GHSA-mg83-c7gq-rv5c
  • org.springframework.security:spring-security-crypto (Maven) Vendor— Affected 6.0.0 to before 6.0.16 Fixed in 6.0.16 Patch available GHSA-mg83-c7gq-rv5c
  • org.springframework.security:spring-security-crypto (Maven) Vendor— Affected 5.8.0 to before 5.8.18 Fixed in 5.8.18 Patch available GHSA-mg83-c7gq-rv5c
  • org.springframework.security:spring-security-crypto (Maven) Vendor— Affected before 5.7.16 Fixed in 5.7.16 Patch available GHSA-mg83-c7gq-rv5c

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*——VMware
  • cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* Versions — — ·VMware

Remediation

  • Fix · CNA Spring Security (Spring) Fixed in 5.7.16, 5.8.18, 6.0.16, 6.1.14, 6.2.10, 6.3.8, 6.4.4
  • Fix · GHSA-mg83-c7gq-rv5c org.springframework.security:spring-security-crypto (Maven) Fixed in 6.3.8 Advisory →
  • Fix · GHSA-mg83-c7gq-rv5c org.springframework.security:spring-security-crypto (Maven) Fixed in 6.4.4 Advisory →
  • Fix · GHSA-mg83-c7gq-rv5c org.springframework.security:spring-security-crypto (Maven) Fixed in 6.2.10 Advisory →
  • Fix · GHSA-mg83-c7gq-rv5c org.springframework.security:spring-security-crypto (Maven) Fixed in 6.1.14 Advisory →
  • Fix · GHSA-mg83-c7gq-rv5c org.springframework.security:spring-security-crypto (Maven) Fixed in 6.0.16 Advisory →
  • Fix · GHSA-mg83-c7gq-rv5c org.springframework.security:spring-security-crypto (Maven) Fixed in 5.8.18 Advisory →
  • Fix · GHSA-mg83-c7gq-rv5c org.springframework.security:spring-security-crypto (Maven) Fixed in 5.7.16 Advisory →

Red Hat 8 advisories

  • RHSA-2025:10120 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1750903529-1.el8, jenkins-2.504.2.1750903189-3.el8
  • RHSA-2025:10118 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1750933270-1.el8, jenkins-2.504.2.1750932984-3.el8
  • RHSA-2025:10119 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1750916671-1.el8, jenkins-2.504.2.1750916374-3.el8
Show 5 more Red Hat advisories
  • RHSA-2025:10104 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.15 jenkins-2-plugins-4.15.1750856638-1.el8, jenkins-2.504.2.1750856366-3.el8
  • RHSA-2025:10098 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.16 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.16 jenkins-2-plugins-4.16.1750857315-1.el9, jenkins-2.504.2.1750857144-3.el9
  • RHSA-2025:10097 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.17 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.17 jenkins-2-plugins-4.17.1750851950-1.el9, jenkins-2.504.2.1750851690-3.el9
  • RHSA-2025:10092 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.18 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.18 jenkins-2-plugins-4.18.1750846854-1.el9, jenkins-2.504.2.1750846524-3.el9
  • RHSA-2025:3543 Released 2025-04-02 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.8.5 for Spring Boot security update.
    • Red Hat build of Apache Camel 4.8.5 for Spring Boot

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
A-MQ Clients 2AffectedNo fix planned: Out of support scope
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
streams for Apache KafkaAffectedNo fix planned: Will not fix
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2025:10118
OpenShift Developer Tools and Services for OCP 4.13Fixed RHSA-2025:10119
OpenShift Developer Tools and Services for OCP 4.14Fixed RHSA-2025:10120
OpenShift Developer Tools and Services for OCP 4.15Fixed RHSA-2025:10104
OpenShift Developer Tools and Services for OCP 4.16Fixed RHSA-2025:10098
OpenShift Developer Tools and Services for OCP 4.17Fixed RHSA-2025:10097
OpenShift Developer Tools and Services for OCP 4.18Fixed RHSA-2025:10092
Red Hat build of Apache Camel 4.8.5 for Spring BootFixed RHSA-2025:3543
Not affected: 5 products
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Single Sign-On 7
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-22228
  2. 2026-10-03 Alias added: GHSA-mg83-c7gq-rv5c

References

Advisory 1

Other 4

  • TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8
See all 1181 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences