Description
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Spring Security | 5.7.16, 5.8.18, 6.0.16, 6.1.14, 6.2.10, 6.3.8, 6.4.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | >= 6.3.8, < 6.3.9 | 6.3.9 | GHSA-vqxh-445g-37fc |
| Maven | org.springframework.security:spring-security-core | >= 6.4.4, < 6.4.5 | 6.4.5 | GHSA-vqxh-445g-37fc |
Advisories 1
- WID-SEC-2025-0869 VMware Tanzu Spring Security: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 4, 2025
References
- Spring Security Advisory: CVE-2025-22234 vendor-advisory