CVE-2025-22234
1 advisory.
Maven/org.springframework.security:spring-security-core CVE-2025-22234: medium 5.3, EPSS 0.39%
Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide
Action: Upgrade org.springframework.security:spring-security-core to 6.3.9 (6.3.x) or 6.4.5 (6.4.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.3.8 | 6.3.9 | - |
| 6.4.4 | 6.4.5 | - |
Fixed versions
| 6.3.9 | 6.4.5 |
Sources
- osv: GHSA-vqxh-445g-37fc
- https://nvd.nist.gov/vuln/detail/CVE-2025-22234
- https://github.com/spring-projects/spring-security
- https://spring.io/security/cve-2025-22234
CVE-2025-22234 · published · modified · JSON