CVE-2025-22228
Fixed in a distro release EPSS <1%CVSS 7.4
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
Products: Spring Security
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework.security:spring-security-crypto | 6.3.8 |
| Maven | org.springframework.security:spring-security-crypto | 6.4.4 |
| Maven | org.springframework.security:spring-security-crypto | 6.2.10 |
| Maven | org.springframework.security:spring-security-crypto | 6.1.14 |
| Maven | org.springframework.security:spring-security-crypto | 6.0.16 |
| Maven | org.springframework.security:spring-security-crypto | 5.8.18 |
| Maven | org.springframework.security:spring-security-crypto | 5.7.16 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | camunda-zeebe-8.6 | 8.6.12-r1 |
| Chainguard | camunda-zeebe-8.6-compat | 8.6.12-r1 |
| Chainguard | geoserver-2.27 | no fix |
| Chainguard | geoserver-2.28 | no fix |
| Chainguard | jenkins-2.479 | 2.479.3-r1 |
| Chainguard | jenkins-2.492 | 2.492.2-r1 |
| Chainguard | kayenta-2025.0 | no fix |
| Chainguard | kayenta-2025.1 | no fix |
| Chainguard | kayenta-2025.2 | no fix |
| Chainguard | kayenta-2025.4 | no fix |
| Chainguard | kayenta-2026.0 | no fix |
| Chainguard | kayenta-2026.1 | no fix |
| Chainguard | kayenta-fips-2025.0 | no fix |
| Chainguard | kayenta-fips-2025.1 | no fix |
| Chainguard | kayenta-fips-2025.2 | no fix |
| Chainguard | kayenta-fips-2025.4 | no fix |
| Chainguard | kayenta-fips-2026.0 | no fix |
| Chainguard | kayenta-fips-2026.1 | no fix |
| Chainguard | keycloak-config-cli | 6.4.0-r3 |
| Chainguard | keycloak-config-cli-bitnami-compat | 6.4.0-r3 |
| Chainguard | keycloak-config-cli-compat | 6.4.0-r3 |
| Chainguard | keycloak-config-cli-iamguarded-compat | 6.4.0-r3 |
| Chainguard | ranger | no fix |
| Chainguard | thingsboard | 3.9.1-r2 |
| Chainguard | thingsboard-tb-js-executor | 3.9.1-r2 |
| Chainguard | thingsboard-tb-mqtt-transport | 3.9.1-r2 |
| Chainguard | thingsboard-tb-node | 3.9.1-r2 |
| Chainguard | thingsboard-tb-web-ui | 3.9.1-r2 |
| Red Hat ocp tools 4.12 | jenkins | 0:2.504.2.1750932984-3.el8 |
| Red Hat ocp tools 4.12 | jenkins-2-plugins | 0:4.12.1750933270-1.el8 |
| Red Hat ocp tools 4.13 | jenkins | 0:2.504.2.1750916374-3.el8 |
| Red Hat ocp tools 4.13 | jenkins-2-plugins | 0:4.13.1750916671-1.el8 |
| Red Hat ocp tools 4.14 | jenkins | 0:2.504.2.1750903189-3.el8 |
| Red Hat ocp tools 4.14 | jenkins-2-plugins | 0:4.14.1750903529-1.el8 |
| Red Hat ocp tools 4.15 | jenkins | 0:2.504.2.1750856366-3.el8 |
| Red Hat ocp tools 4.15 | jenkins-2-plugins | 0:4.15.1750856638-1.el8 |
| Red Hat ocp tools 4.16 | jenkins | 0:2.504.2.1750857144-3.el9 |
| Red Hat ocp tools 4.16 | jenkins-2-plugins | 0:4.16.1750857315-1.el9 |
| Red Hat ocp tools 4.17 | jenkins | 0:2.504.2.1750851690-3.el9 |
| Red Hat ocp tools 4.17 | jenkins-2-plugins | 0:4.17.1750851950-1.el9 |
| Red Hat ocp tools 4.18 | jenkins | 0:2.504.2.1750846524-3.el9 |
| Red Hat ocp tools 4.18 | jenkins-2-plugins | 0:4.18.1750846854-1.el9 |
| Wolfi | keycloak-config-cli | 6.4.0-r3 |
| Wolfi | keycloak-config-cli-bitnami-compat | 6.4.0-r3 |
| Wolfi | keycloak-config-cli-compat | 6.4.0-r3 |
| Wolfi | keycloak-config-cli-iamguarded-compat | 6.4.0-r3 |
| Wolfi | thingsboard | 3.9.1-r2 |
| Wolfi | thingsboard-tb-js-executor | 3.9.1-r2 |
| Wolfi | thingsboard-tb-mqtt-transport | 3.9.1-r2 |
| Wolfi | thingsboard-tb-node | 3.9.1-r2 |
| Wolfi | thingsboard-tb-web-ui | 3.9.1-r2 |