CVE-2025-22234

Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation

State: Published
Severity: 5.3 Medium
Published: Jan 22, 2026
Updated: Jan 22, 2026
Reserved: Jan 2, 2025

Description

The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	vmware

Weaknesses

CWE-208 Timing Descrepency

Affected Products

Product	Versions
Spring SecuritySpring	5.7.16Affected 5.8.18Affected 6.0.16Affected 6.1.14Affected 6.2.10Affected 6.3.8Affected 6.4.4Affected

References

Spring Security Advisory: CVE-2025-22234vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.