Critical Vulnerability in Hibernate Validator: Potential Code Execution Risk
Summary
DEBIAN-CVE-2025-35036: Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. Affects libhibernate-validator-java versions 5.3.6-1 – 5.3.6-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hibernate Validator is a powerful validation framework for Java applications, providing a way to define and enforce constraints on object properties. It is widely used in conjunction with Java Persistence API (JPA) for data validation. This package allows developers to create custom validation messages and constraints, enhancing the robustness of applications. However, a recent vulnerability has been identified that affects versions prior to 6.2.0 and 7.0.0, which could lead to serious security risks if user-supplied input is improperly handled.
Vulnerability Detail
The vulnerability arises from the way Hibernate Validator interpolates user-supplied input in constraint violation messages using Expression Language. This behavior can potentially allow attackers to access sensitive information or execute arbitrary Java code, leading to severe security breaches. The issue is particularly concerning as it can be exploited if the application does not adequately sanitize user input before it is included in validation messages.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers should avoid allowing user-supplied input in constraint violation messages. Instead, use static messages or sanitize inputs thoroughly before including them in any validation messages.
Conclusion
The identified vulnerability in Hibernate Validator poses significant risks to applications that utilize this framework. By updating to the latest versions and adhering to best practices for input handling, developers can protect their applications from potential exploits. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for libhibernate-validator-java →
FAQ
The vulnerability allows for the interpolation of user-supplied input in constraint violation messages, which can lead to code execution or exposure of sensitive information.
Versions prior to 6.2.0 and 7.0.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Update Hibernate Validator to version 6.2.0 or 7.0.0 or later to mitigate the vulnerability.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for libhibernate-validator-java.
