CVE-2025-22234: Spring Security Core Timing Attack Mitigation Flaw
Summary
CVE-2025-22234: Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide. Affects org.springframework.security:spring-security-core across 2 version ranges.
>= 6.3.8, < 6.3.9
>= 6.4.4, < 6.4.5
Fixed in 6.3.9 or 6.4.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Security is a powerful and customizable authentication and access control framework for Java applications. It provides comprehensive security services for Java EE-based enterprise software applications. The framework is widely used for securing web applications and REST APIs. However, a recent vulnerability has been identified in the DaoAuthenticationProvider component, which could potentially expose sensitive information through timing attacks.
Vulnerability Detail
The vulnerability arises from a broken timing attack mitigation implemented in the DaoAuthenticationProvider of Spring Security. This flaw was introduced as a result of a fix applied in CVE-2025-22228. Attackers can exploit this vulnerability to infer valid usernames or other authentication behaviors based on response time differences under specific configurations. This could lead to unauthorized access or further exploitation of the application.
How To Fix
Latest published version: 7.2.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.3.8, < 6.3.96.3.9 -
>= 6.4.4, < 6.4.56.4.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing additional logging or monitoring of authentication attempts to detect unusual patterns that may indicate an attack. However, the best course of action is to apply the patch as soon as possible.
Conclusion
In summary, CVE-2025-22234 is a significant vulnerability in the Spring Security Core framework that can lead to timing attacks, allowing attackers to infer valid usernames. It is crucial to update to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for org.springframework.security:spring-security-core →
FAQ
CVE-2025-22234 is a vulnerability in the Spring Security Core framework that allows attackers to exploit timing differences in authentication responses to infer valid usernames.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using your pom.xml, you can check for vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The primary risk is that attackers can gain insights into valid usernames, potentially leading to unauthorized access and further exploitation of the application.
Update your pom.xml file to include the patched version of the Spring Security Core package. Change the version to 6.3.9 or 6.4.5 as shown in the 'how_to_fix' section.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security:spring-security-core.
