{"action":"Upgrade org.springframework.security:spring-security-crypto to 5.7.16 (5.7.x), 5.8.18 (5.8.x), 6.0.16 (6.0.x), 6.1.14 (6.1.x), 6.2.10 (6.2.x), 6.3.8 (6.3.x) or 6.4.4 (6.4.x) or later.","affected":[{"fixed":"6.3.8","introduced":"6.3.0"},{"fixed":"6.4.4","introduced":"6.4.0"},{"fixed":"6.2.10","introduced":"6.2.0"},{"fixed":"6.1.14","introduced":"6.1.0"},{"fixed":"6.0.16","introduced":"6.0.0"},{"fixed":"5.8.18","introduced":"5.8.0"},{"fixed":"5.7.16","introduced":"0"}],"component":"org.springframework.security:spring-security-crypto","cve_ids":["CVE-2025-22228"],"ecosystem":"Maven","epss":0.0061,"exploited":false,"fixed_versions":["6.3.8","6.4.4","6.2.10","6.1.14","6.0.16","5.8.18","5.7.16"],"ghsa_id":"GHSA-mg83-c7gq-rv5c","id":"tcs_01M5N952XEHCHTN66VTZZBXDQ6","modified_at":"2026-09-10T03:49:48.718826613Z","published_at":"2025-03-20T06:31:09Z","references":["https://osv.dev/vulnerability/GHSA-mg83-c7gq-rv5c","https://nvd.nist.gov/vuln/detail/CVE-2025-22228","https://github.com/spring-projects/spring-security/commit/46f0dc6dfc8402cd556c598fdf2d31f9d46cdbf3","https://github.com/spring-projects/spring-security","https://security.netapp.com/advisory/ntap-20250425-0009","https://spring.io/security/cve-2025-22228"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-mg83-c7gq-rv5c","url":"https://osv.dev/vulnerability/GHSA-mg83-c7gq-rv5c"}],"summary":"Spring Security Does Not Enforce Password Length"}