CVE-2025-22228

Aliases:GHSA-mg83-c7gq-rv5cCGA-3f8r-r9mf-wph4CGA-5vxh-9q89-qhmqCGA-7539-c3xw-83c9CGA-7xgx-mjgr-47r5CGA-8rrv-7c6x-73m6CGA-c7ch-g432-6cj4CGA-gjf9-46c6-98cmCGA-gr43-672h-39r6CGA-jc3m-g43x-hg4wCGA-jrmm-4cxh-jvmmCGA-p2g5-9f2r-2c2qCGA-3f7r-qxxh-94xrCGA-48jf-76h3-35g2CGA-4w47-36xg-wvf2CGA-5pw3-gj99-rq9gCGA-6x27-7gjh-p5jfCGA-75fx-qw6j-m5qpCGA-7863-x3fr-79mfCGA-7jw4-vrr6-f3m6CGA-8w4w-xm5q-qvrhCGA-97v4-v2x9-mc89CGA-cv5p-7vrx-9q66CGA-f2gh-p7vp-jxhpCGA-g279-qf5v-9gm5CGA-h4x2-r9qp-26j3CGA-h877-xvvr-f96fCGA-jjmc-crwh-gc5jCGA-m4rm-9r7x-7v9qCGA-mp64-m592-wggxCGA-mr7v-xv8c-2227CGA-p62v-249h-34frCGA-pf95-97q4-r2xvCGA-ppg6-c8pc-j47vCGA-q37c-qmp2-qfc9CGA-qfh3-v77g-qhc2CGA-qg6w-f6hf-rmgfCGA-qrwh-wxvg-rgh5CGA-rpr5-7m2x-7g58CGA-rvgc-3cm9-5gwqCGA-v6xq-8hpc-726vCGA-vh26-h8h3-f5hfCGA-vv63-f2w7-wm37CGA-w4g3-gx74-m2ffCGA-w6g9-8fg2-9qv6CGA-wgp9-vrvx-rfcmCGA-wj7j-7g5q-mm2mCGA-wmw9-qgr5-fj35CGA-wqgh-5x4q-xmhcCGA-x5cf-pg88-j8mwCGA-xf27-5j4g-mvrm
Advisory lineage Upstream: 0 Downstream: 7
Deferred
Published: 20 Mar 2025, 05:49
Last modified:26 Feb 2026, 19:09

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.4 HIGH
v3.1 (cve.org)
EPSS Score
0.59% LOW
1% probability +0.47%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Mar 2025, 05:49
Published
Vulnerability first disclosed
26 Feb 2026, 19:09
Last Modified
Vulnerability information updated

Description

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

CVSS Metrics

  • v3.1•HIGH•Score: 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 0.59%• Percentile: 47%

Techniques & Countermeasures

  • CWE-287•Improper Authentication

    When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Systems

  • chainguard•camunda-zeebe-8.6

    < 8.6.12-r1

  • chainguard•camunda-zeebe-8.6-compat

    < 8.6.12-r1

  • chainguard•geoserver-2.27

    all

  • chainguard•geoserver-2.28

    all

  • chainguard•kayenta-2025.0

    all

  • chainguard•kayenta-2025.1

    all

  • chainguard•kayenta-2025.2

    all

  • chainguard•kayenta-2025.4

    all

  • chainguard•kayenta-2026.0

    all

  • chainguard•kayenta-2026.1

    all

  • chainguard•kayenta-fips-2025.0

    all

  • chainguard•kayenta-fips-2025.1

    all

  • chainguard•kayenta-fips-2025.2

    all

  • chainguard•kayenta-fips-2025.4

    all

  • chainguard•kayenta-fips-2026.0

    all

  • chainguard•kayenta-fips-2026.1

    all

  • chainguard•keycloak-config-cli

    < 6.4.0-r3

  • chainguard•keycloak-config-cli-compat

    < 6.4.0-r3

  • chainguard•keycloak-config-cli-iamguarded-compat

    < 6.4.0-r3

  • chainguard•ranger

    all

  • chainguard•thingsboard

    < 3.9.1-r2

  • chainguard•thingsboard-tb-js-executor

    < 3.9.1-r2

  • chainguard•thingsboard-tb-mqtt-transport

    < 3.9.1-r2

  • chainguard•thingsboard-tb-node

    < 3.9.1-r2

  • chainguard•thingsboard-tb-web-ui

    < 3.9.1-r2

  • wolfi•keycloak-config-cli

    < 6.4.0-r3

  • wolfi•keycloak-config-cli-compat

    < 6.4.0-r3

  • wolfi•keycloak-config-cli-iamguarded-compat

    < 6.4.0-r3

  • wolfi•thingsboard

    < 3.9.1-r2

  • wolfi•thingsboard-tb-js-executor

    < 3.9.1-r2

  • wolfi•thingsboard-tb-mqtt-transport

    < 3.9.1-r2

  • wolfi•thingsboard-tb-node

    < 3.9.1-r2

  • wolfi•thingsboard-tb-web-ui

    < 3.9.1-r2

  • org.springframework.security•spring-security-crypto

    ≥ 6.3.0, < 6.3.8 | ≥ 6.4.0, < 6.4.4 | ≥ 6.2.0, < 6.2.10 | ≥ 6.1.0, < 6.1.14 | ≥ 6.0.0, < 6.0.16 | ≥ 5.8.0, < 5.8.18 | < 5.7.16

  • spring•spring security

    ≥ 5.7.x, < 5.7.16 | ≥ 5.8.x, < 5.8.18 | ≥ 6.0.x, < 6.0.16 | ≥ 6.1.x, < 6.1.14 | ≥ 6.2.x, < 6.2.10 | ≥ 6.3.x, < 6.3.8 | ≥ 6.4.x, < 6.4.4

References (6)