Log in Start free

Vulnerability · Published Jun 3, 2025 · Assigned by cisa-cg

CVE-2025-35036hibernate-validator insecure default Expression Language interpolation

High 7.3

In plain English

A high-severity code injection in Hibernate Validator from Hibernate. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.8%top 43.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libhibernate-validator-javano fix listedDEBIAN-CVE-2025-35036
Debian:13libhibernate-validator-javano fix listedDEBIAN-CVE-2025-35036
Debian:14libhibernate-validator-javano fix listedDEBIAN-CVE-2025-35036
Debian:12libhibernate-validator4-javano fix listedDEBIAN-CVE-2025-35036
Debian:13libhibernate-validator4-javano fix listedDEBIAN-CVE-2025-35036
Debian:14libhibernate-validator4-javano fix listedDEBIAN-CVE-2025-35036
Mavenorg.hibernate.validator:hibernate-validator7.0.0.CR1GHSA-7v6m-28jr-rg84
Mavenorg.hibernate.validator:hibernate-validator6.2.0.CR1GHSA-7v6m-28jr-rg84
Mavenorg.hibernate:hibernate-validator7.0.0.CR1GHSA-7v6m-28jr-rg84
Mavenorg.hibernate:hibernate-validator6.2.0.CR1GHSA-7v6m-28jr-rg84
Ubuntu:22.04:LTSlibhibernate-validator-javano fix listedUBUNTU-CVE-2025-35036
Ubuntu:24.04:LTSlibhibernate-validator-javano fix listedUBUNTU-CVE-2025-35036
Ubuntu:25.10libhibernate-validator-javano fix listedUBUNTU-CVE-2025-35036
Ubuntu:26.04:LTSlibhibernate-validator-javano fix listedUBUNTU-CVE-2025-35036
Ubuntu:26.10libhibernate-validator-javano fix listedUBUNTU-CVE-2025-35036
Ubuntu:22.04:LTSlibhibernate-validator4-javano fix listedUBUNTU-CVE-2025-35036
Ubuntu:24.04:LTSlibhibernate-validator4-javano fix listedUBUNTU-CVE-2025-35036
Ubuntu:25.10libhibernate-validator4-javano fix listedUBUNTU-CVE-2025-35036
Ubuntu:26.04:LTSlibhibernate-validator4-javano fix listedUBUNTU-CVE-2025-35036
Ubuntu:26.10libhibernate-validator4-javano fix listedUBUNTU-CVE-2025-35036

Affected products (as reported)

VendorProductVersions
Hibernate Hibernate Validator 0 – before 6.2.00 – before 7.0.0

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References