A medium-severity timing attack, CVE-2025-22234, was found in Spring Security's DaoAuthenticationProvider. A fix for a previous password truncation bug inadvertently created a timing leak. Attackers sending 73+ byte passwords could distinguish between valid and invalid usernames based on server response times, enabling enumeration. A proof-of-concept exploit is available.

The vulnerability stems from an early length check that throws an exception before the constant-time BCrypt comparison. This bypasses the security measure designed to prevent timing attacks. The flaw affects numerous Spring Security versions, including 6.4.4, 6.3.8, and 5.8.18. Patches are available in 6.4.5, 6.3.9, and 5.8.19.

Developers should upgrade immediately to a patched release. Mitigation also includes implementing generic rate limiting on login endpoints and monitoring for error spikes that may indicate active exploitation. This incident highlights the difficulty of maintaining constant-time operations during authentication, a critical requirement for preventing side-channel attacks.