CVE-2025-22234
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Jan 22, 2026
CISA due date
—
The record
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-core | 6.3.8 | 6.3.9 |
| Maven | org.springframework.security:spring-security-core | 6.4.4 | 6.4.5 |
| maven | org.springframework.security/spring-security-core | 6.3.8 | No fix |
| maven | org.springframework.security/spring-security-core | 6.3.8 | 6.3.9 |
| maven | org.springframework.security/spring-security-core | 6.4.4 | No fix |
| maven | org.springframework.security/spring-security-core | 6.4.4 | 6.4.5 |
Related vulnerabilities
- GHSA-vqxh-445g-37fc Spring Security has a broken timing attack mitigation implemented in… Same vulnerability
- CVE-2024-38827 The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent… Also affects org.springframework.security:spring-security-core
- CVE-2024-22257 In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x… Also affects org.springframework.security:spring-security-core
- CVE-2024-22234 In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an… Also affects org.springframework.security:spring-security-core
- CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
- CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
- CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208
- CVE-2026-54875 Issue summary: A non-constant-time optimized implementation of scalar point… CWE-208