ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator…
Priority LOW 28CWE-264Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Partial Red Hat: 8 fixed, 10 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264.
Summary
ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.
Why it matters now
EPSS 0.02913 87th percentileScored 2026-11-07
Fix Partial org.hibernate:hibernate-validator (Maven): 4.2.1, 4.3.2, 5.1.2Red Hat: 8 advisoriesRed Hat: 8 fixed, 10 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.hibernate:hibernate-validator (Maven) | 4.1.0 to before 4.2.1 | 4.2.1 | Patch available | GHSA-845h-985r-jrqh |
| — | org.hibernate:hibernate-validator (Maven) | 4.3.0 to before 4.3.2 | 4.3.2 | Patch available | GHSA-845h-985r-jrqh |
| — | org.hibernate:hibernate-validator (Maven) | 5.0.0 to before 5.1.2 | 5.1.2 | Patch available | GHSA-845h-985r-jrqh |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.hibernate:hibernate-validator (Maven) Vendor— Affected 4.1.0 to before 4.2.1 Fixed in 4.2.1 Patch available GHSA-845h-985r-jrqh
- org.hibernate:hibernate-validator (Maven) Vendor— Affected 4.3.0 to before 4.3.2 Fixed in 4.3.2 Patch available GHSA-845h-985r-jrqh
- org.hibernate:hibernate-validator (Maven) Vendor— Affected 5.0.0 to before 5.1.2 Fixed in 5.1.2 Patch available GHSA-845h-985r-jrqh
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:hibernate_validator:*:*:*:*:*:*:*:* | 4.3.0 to before 4.3.2; 5.0.0 – 5.0.3; 5.1.0 to before 5.1.2 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:hibernate_validator:4.1.0:*:*:*:*:*:*:* | 4.1.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:hibernate_validator:4.2.0:*:*:*:*:*:*:* | 4.2.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:hibernate_validator:4.2.0:beta1:*:*:*:*:*:* | 4.2.0 beta1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:hibernate_validator:4.2.0:beta2:*:*:*:*:*:* | 4.2.0 beta2 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:hibernate_validator:4.2.0:cr1:*:*:*:*:*:* | 4.2.0 cr1 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:hibernate_validator:*:*:*:*:*:*:*:* Versions 4.3.0 to before 4.3.2; 5.0.0 – 5.0.3; 5.1.0 to before 5.1.2 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:hibernate_validator:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:hibernate_validator:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:hibernate_validator:4.2.0:beta1:*:*:*:*:*:* Versions 4.2.0 beta1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:hibernate_validator:4.2.0:beta2:*:*:*:*:*:* Versions 4.2.0 beta2 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:hibernate_validator:4.2.0:cr1:*:*:*:*:*:* Versions 4.2.0 cr1 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-845h-985r-jrqh org.hibernate:hibernate-validator (Maven) Fixed in 4.2.1 Advisory →
- Fix · GHSA-845h-985r-jrqh org.hibernate:hibernate-validator (Maven) Fixed in 4.3.2 Advisory →
- Fix · GHSA-845h-985r-jrqh org.hibernate:hibernate-validator (Maven) Fixed in 5.1.2 Advisory →
Red Hat 8 advisories
- RHSA-2015:0720 Released 2015-03-24 · Red Hat rating ImportantRed Hat JBoss Fuse Service Works 6.0.0 security update
- Red Hat JBoss Fuse Service Works 6.0
- RHSA-2015:0234 Released 2015-02-17 · Red Hat rating ImportantRed Hat JBoss BPM Suite 6.0.3 security update
- Red Hat JBoss BPMS 6.0
- RHSA-2015:0235 Released 2015-02-17 · Red Hat rating ImportantRed Hat JBoss BRMS 6.0.3 security update
- Red Hat JBoss BRMS 6.0
Show 5 more Red Hat advisories
- RHSA-2015:0125 Released 2015-02-04 · Red Hat rating ImportantRed Hat JBoss Web Framework Kit 2.7.0 update
- Red Hat JBoss Web Framework Kit 2.7
- RHSA-2014:1285 Released 2014-09-23 · Red Hat rating LowRed Hat JBoss Enterprise Application Platform 6.3.1 update
- Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server glassfish-jaxb-eap6-2.2.5-22.redhat_9.1.ep6.el6, glassfish-jsf-eap6-2.1.28-5.redhat_6.1.ep6.el6, hibernate4-core-eap6-4.2.14-8.SP3_redhat_1.1.ep6.el6 +47
- RHSA-2014:1286 Released 2014-09-23 · Red Hat rating LowRed Hat JBoss Enterprise Application Platform 6.3.1 update
- Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server glassfish-jaxb-eap6-2.2.5-22.redhat_9.1.ep6.el5, glassfish-jsf-eap6-2.1.28-5.redhat_6.1.ep6.el5, hibernate4-core-eap6-4.2.14-8.SP3_redhat_1.1.ep6.el5 +47
- RHSA-2014:1287 Released 2014-09-23 · Red Hat rating LowRed Hat JBoss Enterprise Application Platform 6.3.1 update
- Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server glassfish-jaxb-eap6-2.2.5-22.redhat_9.1.ep6.el7, glassfish-jsf-eap6-2.1.28-5.redhat_6.1.ep6.el7, hibernate4-core-eap6-4.2.14-8.SP3_redhat_1.1.ep6.el7 +47
- RHSA-2014:1288 Released 2014-09-23 · Red Hat rating LowRed Hat JBoss Enterprise Application Platform 6.3.1 update
- Red Hat JBoss Enterprise Application Platform 6.3
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Virtualization 3 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 6 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Operations Network 3 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Portal 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Portal 6 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss BPMS 6.0 | Fixed | RHSA-2015:0234 |
| Red Hat JBoss BRMS 6.0 | Fixed | RHSA-2015:0235 |
| Red Hat JBoss Enterprise Application Platform 6.3 | Fixed | RHSA-2014:1288 |
| Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 5 Server | Fixed | RHSA-2014:1286 |
| Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 6 Server | Fixed | RHSA-2014:1285 |
| Red Hat JBoss Enterprise Application Platform 6.3 for RHEL 7 Server | Fixed | RHSA-2014:1287 |
| Red Hat JBoss Fuse Service Works 6.0 | Fixed | RHSA-2015:0720 |
| Red Hat JBoss Web Framework Kit 2.7 | Fixed | RHSA-2015:0125 |
Not affected: 5 products
- Red Hat JBoss Enterprise Application Platform 5
- Red Hat JBoss Enterprise Web Server 1
- Red Hat JBoss Enterprise Web Server 2
- Red Hat Satellite 5
- Red Hat Subscription Asset Manager
Timeline
- 2026-10-02 Threatist record created from CVE-2014-3558
- 2026-10-03 Alias added: GHSA-845h-985r-jrqh
References
Advisory 9
Other 9
- https://github.com/hibernate/hibernate-validator/commit/2c95d4ea0ef20977be249e31a4a4f4f4f71c945d
- https://github.com/hibernate/hibernate-validator/commit/67fdff14831c035c25e098fe14bd86523d17f726
- https://github.com/hibernate/hibernate-validator/commit/7e7131939a4361a7cad3e77ab89a8462132c561c
- https://github.com/hibernate/hibernate-validator/commit/c489416f699a46859c134796b3ccfea41ef3ce52
- https://github.com/hibernate/hibernate-validator/commit/c9525ca544b1281e2b7c7347e86e87c86dc1dc6e
- https://github.com/hibernate/hibernate-validator/commit/e8c42b689df8c6752d635d02c6518da3fece3870
- https://github.com/hibernate/hibernate-validator/commit/f97c2021a03c825abdeca1692f5be51e77e76a8f
- https://github.com/hibernate/hibernate-validator/commit/fd4eaed7fb930db6a5e4c03742b4b3adcfecc90e
- https://github.com/hibernate/hibernate-validator
More Red Hat Hibernate Validator vulnerabilities
- TI-2025-24565 hibernate-validator insecure default Expression Language interpolation CVSS 4.0MEDIUM 6.9
- TI-2019-07539 Cross-site scripting in hibernate-validator CVSS 3.1MEDIUM 6.1
- TI-2017-05177 In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when… CVSS 3.1HIGH 7.0
- TI-2020-08595 Improper input validation in hibernate-validator CVSS 3.1MEDIUM 5.3
Sources
- CVE-2014-3558 · CVE Program
- CVE-2014-3558 · NVD
- FIRST EPSS
- GHSA-845h-985r-jrqh · GitHub Advisory Database · CC BY 4.0
- CVE-2014-3558 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences