Critical Vulnerability in Hibernate Validator: User Input Interpolation Risk
Summary
CVE-2025-35036: Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. Affects libhibernate-validator-java across 4 version ranges.
< 05f795bb7cf18856004f40e5042709e550ed0d6e
< 254858d9dcc4e7cd775d1b0f47f482218077c5e1
< d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78
< e076293b0ee1bfa97b6e67d05ad9eee1ad77e893
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hibernate Validator is a popular library used in Java applications for validating user input and ensuring data integrity. It provides a framework for defining constraints on object properties and validating them at runtime. The library is widely utilized in various Java frameworks, including Spring and Java EE. However, prior to versions 6.2.0 and 7.0.0, Hibernate Validator had a significant vulnerability that allowed user-supplied input to be interpolated in constraint violation messages, potentially exposing sensitive information or allowing arbitrary code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2025-35036, arises from the default behavior of Hibernate Validator, which interpolates user-supplied input into constraint violation messages using Expression Language. This could enable an attacker to manipulate the input and gain unauthorized access to sensitive data or execute arbitrary Java code. The issue is particularly concerning as it can lead to severe security breaches if exploited. The vulnerability affects multiple versions of the library across various Debian ecosystems, including libhibernate-validator-java and libhibernate-validator4-java.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using user-supplied input in constraint violation messages. Instead, use static messages or predefined templates that do not include dynamic content. This can be achieved by configuring your validation messages in a way that does not allow interpolation of user data.
Conclusion
The CVE-2025-35036 vulnerability in Hibernate Validator poses a serious risk due to the interpolation of user-supplied input in constraint violation messages. It is crucial for developers to update to the latest versions of the library and implement best practices to mitigate potential security threats. Regular monitoring and vulnerability assessments, such as those provided by Vulert, can help maintain application security.
See every vulnerability recorded for libhibernate-validator-java →
FAQ
CVE-2025-35036 is a critical vulnerability in Hibernate Validator that allows user-supplied input to be interpolated in constraint violation messages, potentially leading to sensitive data exposure or arbitrary code execution.
Versions of Hibernate Validator prior to 6.2.0 and 7.0.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement a workaround by avoiding user-supplied input in constraint violation messages and using static messages instead.
Exploitation of this vulnerability could lead to unauthorized access to sensitive information or the execution of arbitrary Java code, posing significant security risks to applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for libhibernate-validator-java.
