Description
Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Hibernate | Hibernate Validator | < 6.2.0, < 7.0.0 | 6.2.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libhibernate-validator-java +1 | No fix yet | — |
| Debian 13 | libhibernate-validator-java +1 | No fix yet | — |
| Debian 12 | libhibernate-validator-java +1 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libhibernate-validator-java +1 | No fix yet | — |
| Ubuntu 26.04 LTS | libhibernate-validator-java +1 | No fix yet | — |
| Ubuntu 25.10 | libhibernate-validator-java +1 | No fix yet | — |
| Ubuntu 24.04 LTS | libhibernate-validator-java +1 | No fix yet | — |
| Ubuntu 22.04 LTS | libhibernate-validator-java +1 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libhibernate-validator-java +1 | No fix yet | — |
| Ubuntu 18.04 LTS | libhibernate-validator-java | No fix yet | — |
| Ubuntu 16.04 LTS | libhibernate-validator-java | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.16.0-21.redhat_00055.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.5.10-1.redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 1:1.0.2-5.redhat_00004.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.9.6-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.14-9.SP10_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.27-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-hibernate-validator +1 | 6.0.23-3.SP2_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.21-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-42.Final_redhat_00042.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.4.15-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.23-3.GA_redhat_00002.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.26-1.Final_redhat_00001.1.el7eap | RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.23-3.GA_redhat_00002.1.el8eap | RHSA-2025:10926, RHSA-2025:10925 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.hibernate:hibernate-validator | < 6.2.0.CR1 | 6.2.0.CR1 | GHSA-7v6m-28jr-rg84 |
| Maven | org.hibernate:hibernate-validator | >= 7.0.0.Alpha1, < 7.0.0.CR1 | 7.0.0.CR1 | GHSA-7v6m-28jr-rg84 |
| Maven | org.hibernate.validator:hibernate-validator | < 6.2.0.CR1 | 6.2.0.CR1 | GHSA-7v6m-28jr-rg84 |
| Maven | org.hibernate.validator:hibernate-validator | >= 7.0.0.Alpha1, < 7.0.0.CR1 | 7.0.0.CR1 | GHSA-7v6m-28jr-rg84 |
Advisories 5
- WID-SEC-2026-2189 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- RHSA-2025:10926 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:10925 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2025:10924 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2026-1203 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026