CVE-2025-22228

1. Affected product: Spring Security
2. Affected packages: spring-security-crypto
3. Affected versions:
   • 5.6.12 and older
   • 5.7.0 – 5.7.15
   • 5.8.0 – 5.8.17
   • 6.0.0 – 6.0.15
   • 6.1.0 – 6.1.13
   • 6.2.0 – 6.2.9
   • 6.3.0 – 6.3.7
   • 6.4.0 – 6.4.3
4. GitHub repository:
   • https://github.com/spring-projects/spring-security
5. Published packages:
   • https://mvnrepository.com/artifact/org.springframework.security/spring-security-crypto
6. Fixed In:ELS for Spring Security v5.8.16.TuxCare

BCrypt-hashed passwords have a maximum length of 72 characters. The hashpw function in the BCrypt class of spring-security-crypto hashes only the first 72 characters of a password. Any password longer than this will only be validated based on its first 72 characters.

After applying the patch, existing passwords exceeding 72 characters need to be reset for proper functioning, as a user with such a password will simply not be able to login. New passwords with lengths exceeding 72 characters are not accepted.

Applying the test (credit: Joe Grandja) below allows us to test this vulnerability.

@Test
   public void enforcePasswordLength() {
       BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
       String password72chars = "123456789012345678901234567890123456789012345678901234567890123456789012";
       assertThat(encoder.matches(password72chars, encoder.encode(password72chars))).isTrue();
       String password73chars = password72chars.concat("a");
       assertThatIllegalArgumentException()
           .isThrownBy(() -> encoder.matches(password73chars, encoder.encode(password73chars)));
   }

Spring Security 5.8.x is no longer supported by the open-source community, as its End of Life date is 2023-12-31. This simply means that versions from that date do not receive any updates to address this issue.

‍Users of the affected components should apply one of the following mitigations:

• Leverage TuxCare’s Endless Lifecycle Support, which extends regular community EOL security support.
• Alternatively take the effort to upgrade to the newer still-supported Spring Security open-source versions that have integrated the fix: 6.3.8 or 6.4.4

Do you need a fix for this vulnerability for any other Spring Security version, please contact us, we are here to help you!

• https://nvd.nist.gov/vuln/detail/CVE-2025-22228
• https://spring.io/security/cve-2025-22228
• spring-projects/spring-security@46f0dc6