CVE-2025-22228 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length
Attackers can bypass authentication by providing passwords that share the first 72 characters with the valid password, exploiting BCrypt's truncation behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-22228?
CVE-2025-22228 is a high-severity authentication bypass vulnerability in Spring Security, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
Weakness: CWE-287
Which versions are affected by CVE-2025-22228?
14 open source packages ship an affected version, including org.springframework.security:spring-security-crypto.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.security:spring-security-crypto Maven | All versions | 5.7.16 |
org.springframework.security:spring-security-crypto Maven | All versions | 5.7.16 |
org.springframework.security:spring-security-crypto Maven | From 5.8.0 | 5.8.18 |
org.springframework.security:spring-security-crypto Maven | From 5.8.0 | 5.8.18 |
org.springframework.security:spring-security-crypto Maven | From 6.0.0 | 6.0.16 |
org.springframework.security:spring-security-crypto Maven | From 6.0.0 | 6.0.16 |
8 more packages
org.springframework.security:spring-security-crypto Maven | From 6.1.0 | 6.1.14 |
org.springframework.security:spring-security-crypto Maven | From 6.1.0 | 6.1.14 |
org.springframework.security:spring-security-crypto Maven | From 6.2.0 | 6.2.10 |
org.springframework.security:spring-security-crypto Maven | From 6.2.0 | 6.2.10 |
org.springframework.security:spring-security-crypto Maven | From 6.3.0 | 6.3.8 |
org.springframework.security:spring-security-crypto Maven | From 6.3.0 | 6.3.8 |
org.springframework.security:spring-security-crypto Maven | From 6.4.0 | 6.4.4 |
org.springframework.security:spring-security-crypto Maven | From 6.4.0 | 6.4.4 |
How do I fix CVE-2025-22228?
Upgrade org.springframework.security:spring-security-crypto to a fixed version for your release line: 5.7.16, 5.8.18, 6.0.16 or 6.1.14.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-22228 being exploited?
There is no known exploitation of CVE-2025-22228 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-QB26194, CLSA-2025-1742947247, ECHO-0d82-8e9f-d92a, GHSA-mg83-c7gq-rv5c, MINI-5jfg-gm2f-5p33, MINI-6x3f-vp3m-79mf and 4 more.