CVE-2025-22234: Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22234?
CVE-2025-22234 is categorized as a high severity vulnerability due to its potential to allow timing attacks that can expose valid usernames.
How do I fix CVE-2025-22234?
To address CVE-2025-22234, upgrade to Spring Security version 6.4.5 or 6.3.9.
What are the risks associated with not fixing CVE-2025-22234?
Failure to fix CVE-2025-22234 may lead to unauthorized access through username enumeration via timing attacks.
Which versions of Spring Security are affected by CVE-2025-22234?
CVE-2025-22234 affects Spring Security versions 6.4.4 and 6.3.8.
Is CVE-2025-22234 related to any previous vulnerabilities?
CVE-2025-22234 is related to CVE-2025-22228 as the fix implemented for it inadvertently introduced this vulnerability.