Riskcovery

CVE-2025-35036

hibernate-validator insecure default Expression Language interpolation

State
Published
Severity
6.9 Medium
Published
Jun 3, 2025
Updated
Jun 5, 2025
Reserved
Apr 15, 2025

Read the record on cve.org

Description

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:Ncisa-cg
3.17.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lcisa-cg

Weaknesses

  • CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

ProductVersions
Hibernate ValidatorHibernate
  • before 6.2.0Affected
  • before 7.0.0Affected
  • 6.2.0Not affected
  • 7.0.0Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.