CVE-2025-35036: Hibernate Validator Vulnerability in Constraint Violation Message Interpolation
Summary
CVE-2025-35036: Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. Affects org.hibernate.validator:hibernate-validator across 2 version ranges.
< 6.2.0.CR1
>= 7.0.0.Alpha1, < 7.0.0.CR1
Fixed in 6.2.0.CR1 or 7.0.0.CR1, depending on the release line you run. How to fix ↓
Also tracked for
- libhibernate-validator-java · Debian:11
The same CVE-2025-35036 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hibernate Validator is a popular framework used for validating Java objects. It provides a way to define validation rules using annotations and supports complex validation scenarios. The framework is widely used in Java applications to ensure data integrity and enforce business rules. However, prior to versions 6.2.0 and 7.0.0, Hibernate Validator had a vulnerability that allowed user-supplied input to be interpolated in constraint violation messages, potentially leading to security risks.
Vulnerability Detail
The vulnerability arises from the way Hibernate Validator handles constraint violation messages. In versions before 6.2.0 and 7.0.0, the framework may interpolate user-supplied input using Expression Language, which could allow attackers to access sensitive information or execute arbitrary Java code. This vulnerability is classified under CWE-94 (Code Injection) and has a CVSS score of 7.3, indicating a moderate severity level. Examples of related vulnerabilities include CVE-2020-5245 and CVE-2025-4428.
How To Fix
Latest published version: 9.2.0.Beta1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.2.0.CR16.2.0.CR1 -
>= 7.0.0.Alpha1, < 7.0.0.CR17.0.0.CR1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid allowing user-supplied input in constraint violation messages. Ensure that any messages displayed to users do not include dynamic content that could be influenced by user input.
Conclusion
The Hibernate Validator vulnerability (CVE-2025-35036) poses a risk of code injection through user-supplied input in constraint violation messages. It is crucial to update to the patched versions to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for org.hibernate.validator:hibernate-validator →
FAQ
The vulnerability can lead to unauthorized access to sensitive information or execution of arbitrary Java code, posing a significant security risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without any signup.
Versions prior to 6.2.0 and 7.0.0 are affected by this vulnerability.
If immediate updates are not possible, implement a workaround by ensuring that user-supplied input is not included in constraint violation messages.
Yes, you can mitigate the risk by sanitizing user inputs and avoiding their inclusion in error messages.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.hibernate.validator:hibernate-validator.
