Critical Vulnerability in Hibernate Validator Package: Potential for Code Execution and Information Disclosure
Summary
UBUNTU-CVE-2025-35036: Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. Affects libhibernate-validator-java versions 4.2.1-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hibernate Validator is a powerful validation framework for Java applications, providing a way to define validation rules for JavaBeans. It is widely used in various applications to ensure data integrity and enforce business rules. However, certain versions of Hibernate Validator are susceptible to a vulnerability that allows user-supplied input to be interpolated in constraint violation messages, potentially leading to security risks.
Vulnerability Detail
The vulnerability arises from the interpolation of user-supplied input in constraint violation messages using Expression Language. This behavior can allow attackers to access sensitive information or execute arbitrary Java code, posing a significant security threat. The issue affects versions prior to 6.2.0 and 7.0.0, where the framework does not adequately sanitize user input in error messages. This vulnerability is classified with a CVSS score of 7.3, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid allowing user-supplied input in constraint violation messages. This can be achieved by reviewing the code where validation messages are generated and ensuring that no user input is included in those messages.
Conclusion
In summary, the vulnerability in Hibernate Validator poses a significant risk due to the interpolation of user-supplied input in error messages. It is crucial for users to update to the latest versions to mitigate this risk. Additionally, employing workarounds can help reduce exposure until an update can be applied.
See every vulnerability recorded for libhibernate-validator-java →
FAQ
Versions prior to 6.2.0 and 7.0.0 are affected by this vulnerability.
The vulnerability may allow attackers to access sensitive information or execute arbitrary Java code, leading to severe security breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.3, indicating a high severity level.
If immediate updates are not possible, ensure that user-supplied input is not included in constraint violation messages as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for libhibernate-validator-java.
