Improper Input Validation in Hibernate Validator Affects Sensitive Data Exposure
CVE-2025-35036

6.9MEDIUM

Key Information:

Vendor

Hibernate

Status
Hibernate Validator
Vendor
CVE Published:
3 June 2025

What is CVE-2025-35036?

Hibernate Validator versions prior to 6.2.0 and 7.0.0 may allow attackers to manipulate user-supplied input within constraint violation messages utilizing Expression Language. This poses a risk of exposing sensitive information or executing arbitrary Java code. The updated versions have addressed this issue and strongly recommend against incorporating user data in constraint violation messages, ensuring enhanced security against such vulnerabilities.

Affected Version(s)

Hibernate Validator 0 < 6.2.0

Hibernate Validator 0 < 7.0.0

Hibernate Validator 6.2.0

References

https://hibernate.org/validator/documentation/migration-g...
https://in.relation.to/2021/01/06/hibernate-validator-700...
https://docs.jboss.org/hibernate/stable/validator/referen...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.