Description
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Spring Security | 5.7.x – < 5.7.16, 5.8.x – < 5.8.18, 6.0.x – < 6.0.16, 6.1.x – < 6.1.14, 6.2.x – < 6.2.10, 6.3.x – < 6.3.8, 6.4.x – < 6.4.4 | 5.7.16 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ocp Tools 4 | jenkins | 2.504.2.1750846524-3.el9 | RHSA-2025:10120, RHSA-2025:10119, RHSA-2025:10118 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.12.1750933270-1.el8 | RHSA-2025:10120, RHSA-2025:10119, RHSA-2025:10118 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | keycloak-config-cli +2 | 6.4.0-r3 | — |
| Wolfi rolling | thingsboard +4 | 3.9.1-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.security:spring-security-crypto | >= 6.3.0, < 6.3.8 | 6.3.8 | GHSA-mg83-c7gq-rv5c |
| Maven | org.springframework.security:spring-security-crypto | >= 6.4.0, < 6.4.4 | 6.4.4 | GHSA-mg83-c7gq-rv5c |
| Maven | org.springframework.security:spring-security-crypto | >= 6.2.0, < 6.2.10 | 6.2.10 | GHSA-mg83-c7gq-rv5c |
| Maven | org.springframework.security:spring-security-crypto | >= 6.1.0, < 6.1.14 | 6.1.14 | GHSA-mg83-c7gq-rv5c |
| Maven | org.springframework.security:spring-security-crypto | >= 6.0.0, < 6.0.16 | 6.0.16 | GHSA-mg83-c7gq-rv5c |
| Maven | org.springframework.security:spring-security-crypto | >= 5.8.0, < 5.8.18 | 5.8.18 | GHSA-mg83-c7gq-rv5c |
| Maven | org.springframework.security:spring-security-crypto | < 5.7.16 | 5.7.16 | GHSA-mg83-c7gq-rv5c |
Advisories 16
- WID-SEC-2025-1439 Dell Secure Connect Gateway: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2026-1955 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 23, 2026
- RHSA-2025:10120 Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2025:10118 Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2025:10119 Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2025:10104 Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2025:10097 Red Hat Security Advisory: Red Hat Product OCP Tools 4.17 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2025:10098 Red Hat Security Advisory: Red Hat Product OCP Tools 4.16 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- RHSA-2025:10092 Red Hat Security Advisory: Red Hat Product OCP Tools 4.18 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 15, 2026
- WID-SEC-2026-0351 Dell NetWorker (Third Party Components): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- NCSC-2026-0025 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0163 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2025-0602 VMware Tanzu Spring Security: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 25, 2025
- WID-SEC-2025-1989 SAP Patchday September 2025: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 23, 2025
- NCSC-2025-0275 Kwetsbaarheden verholpen in SAP producten NCSC-NL (Netherlands) · Sep 9, 2025
- WID-SEC-2025-1344 Atlassian Confluence: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 17, 2025