Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.springframework.security/spring-security-crypto@6.1.0
purl pkg:maven/org.springframework.security/spring-security-crypto@6.1.0
Next non-vulnerable version 6.3.8
Latest non-vulnerable version 6.4.4
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-vghg-4esd-cbc6
Aliases:
CVE-2025-22228
GHSA-mg83-c7gq-rv5c
Spring Security Does Not Enforce Password Length BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
6.1.14
Affected by 0 other vulnerabilities.
6.2.10
Affected by 0 other vulnerabilities.
6.3.8
Affected by 0 other vulnerabilities.
6.4.4
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-07T04:57:19.598750+00:00 GHSA Importer Affected by VCID-vghg-4esd-cbc6 https://github.com/advisories/GHSA-mg83-c7gq-rv5c 38.1.0