Read the docs
TI-2025-24565 Aliases CVE-2025-35036GHSA-7v6m-28jr-rg84

hibernate-validator insecure default Expression Language interpolation

Priority MEDIUM 64CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 4 fixed, 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00781 56th percentileScored 2026-11-07
Fix Partial Hibernate Validator (Hibernate): 6.2.0, 7.0.0org.hibernate.validator:hibernate-validator (Maven): 6.2.0.CR1, 7.0.0.CR1+1 more productRed Hat: 4 advisoriesRed Hat: 4 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HibernateHibernate Validatorbefore 6.2.0; before 7.0.06.2.0, 7.0.0Patch availableCNA
—org.hibernate.validator:hibernate-validator (Maven)before 6.2.0.CR16.2.0.CR1Patch availableGHSA-7v6m-28jr-rg84
—org.hibernate.validator:hibernate-validator (Maven)7.0.0.Alpha1 to before 7.0.0.CR17.0.0.CR1Patch availableGHSA-7v6m-28jr-rg84
—org.hibernate:hibernate-validator (Maven)before 6.2.0.CR16.2.0.CR1Patch availableGHSA-7v6m-28jr-rg84
—org.hibernate:hibernate-validator (Maven)7.0.0.Alpha1 to before 7.0.0.CR17.0.0.CR1Patch availableGHSA-7v6m-28jr-rg84
  • Hibernate Validator VendorHibernate Affected before 6.2.0; before 7.0.0 Fixed in 6.2.0, 7.0.0 Patch available CNA
  • org.hibernate.validator:hibernate-validator (Maven) Vendor— Affected before 6.2.0.CR1 Fixed in 6.2.0.CR1 Patch available GHSA-7v6m-28jr-rg84
  • org.hibernate.validator:hibernate-validator (Maven) Vendor— Affected 7.0.0.Alpha1 to before 7.0.0.CR1 Fixed in 7.0.0.CR1 Patch available GHSA-7v6m-28jr-rg84
  • org.hibernate:hibernate-validator (Maven) Vendor— Affected before 6.2.0.CR1 Fixed in 6.2.0.CR1 Patch available GHSA-7v6m-28jr-rg84
  • org.hibernate:hibernate-validator (Maven) Vendor— Affected 7.0.0.Alpha1 to before 7.0.0.CR1 Fixed in 7.0.0.CR1 Patch available GHSA-7v6m-28jr-rg84

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:hibernate_validator:*:-:*:*:*:*:*:*before 6.2.0VulnerableRed Hat
  • cpe:2.3:a:redhat:hibernate_validator:*:-:*:*:*:*:*:* Versions before 6.2.0 Vulnerable ·Red Hat

Remediation

  • Fix · CNA Hibernate Validator (Hibernate) Fixed in 6.2.0, 7.0.0
  • Fix · GHSA-7v6m-28jr-rg84 org.hibernate.validator:hibernate-validator (Maven) Fixed in 6.2.0.CR1 Advisory →
  • Fix · GHSA-7v6m-28jr-rg84 org.hibernate.validator:hibernate-validator (Maven) Fixed in 7.0.0.CR1 Advisory →
  • Fix · GHSA-7v6m-28jr-rg84 org.hibernate:hibernate-validator (Maven) Fixed in 6.2.0.CR1 Advisory →
  • Fix · GHSA-7v6m-28jr-rg84 org.hibernate:hibernate-validator (Maven) Fixed in 7.0.0.CR1 Advisory →

Red Hat 4 advisories

  • RHSA-2025:10931 Released 2025-07-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2025:10925 Released 2025-07-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-21.redhat_00055.1.el8eap, eap7-activemq-artemis-cli-2.16.0-21.redhat_00055.1.el8eap, eap7-activemq-artemis-commons-2.16.0-21.redhat_00055.1.el8eap +46
  • RHSA-2025:10924 Released 2025-07-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-21.redhat_00055.1.el7eap, eap7-activemq-artemis-cli-2.16.0-21.redhat_00055.1.el7eap, eap7-activemq-artemis-commons-2.16.0-21.redhat_00055.1.el7eap +45
Show 1 more Red Hat advisories
  • RHSA-2025:10926 Released 2025-07-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.23 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-21.redhat_00055.1.el9eap, eap7-activemq-artemis-cli-2.16.0-21.redhat_00055.1.el9eap, eap7-activemq-artemis-commons-2.16.0-21.redhat_00055.1.el9eap +46

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
streams for Apache KafkaAffectedNo fix yet
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2025:10924
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2025:10925
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2025:10926
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2025:10931
Not affected: 6 products
  • A-MQ Clients 2
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-35036
  2. 2026-10-03 Alias added: GHSA-7v6m-28jr-rg84

References

Patch 4

Advisory 1

Other 11

  • TI-2020-15656 SQL injection in hibernate-core CVSS 3.1HIGH 7.4
  • TI-2019-11104 SQL injection in Hibernate CVSS 3.1MEDIUM 6.5
  • TI-2019-07539 Cross-site scripting in hibernate-validator CVSS 3.1MEDIUM 6.1
  • TI-2020-08595 Improper input validation in hibernate-validator CVSS 3.1MEDIUM 5.3
  • TI-2023-01816 Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences