Description
A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ESAPI | esapi-java-legacy | 2.0-rc10, 2.0-rc11, 2.0.1, 2.0GA1, 2.1.0, 2.1.0.1, 2.2.0.0, 2.2.0.0-RC1, 2.2.0.0-RC2, 2.2.0.0-RC3, 2.2.1.0, 2.2.1.0-RC1, 2.2.1.1, 2.2.2.0, 2.2.3.0, 2.2.3.1, 2.3.0.0, 2.4.0.0, 2.5.0.0, 2.5.1.0, 2.5.2.0, 2.5.3.0, 2.5.3.1, 2.5.4.0, 2.5.5.0, 2.6.0.0, 2.6.1.0, 2.6.2.0 | 2.7.0.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | libowasp-esapi-java | No fix yet | — |
| Debian 12 | libowasp-esapi-java | No fix yet | — |
| Debian 11 | libowasp-esapi-java | 2.4.0.0-0+deb11u1 | DLA-4246-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libowasp-esapi-java | No fix yet | — |
| Ubuntu 26.04 LTS | libowasp-esapi-java | No fix yet | — |
| Ubuntu 25.10 | libowasp-esapi-java | No fix yet | — |
| Ubuntu 24.04 LTS | libowasp-esapi-java | 2.4.0.0-2ubuntu0.1 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | libowasp-esapi-java | 2.2.3.1-1ubuntu0.1~esm1 | — |
| Ubuntu Pro 20.04 LTS | libowasp-esapi-java | 2.1.0-3ubuntu0.20.04.1~esm1 | — |
| Ubuntu Pro 18.04 LTS | libowasp-esapi-java | 2.1.0-3ubuntu0.18.04.1~esm1 | — |
| Ubuntu Pro 16.04 LTS | libowasp-esapi-java | 2.1.0-2ubuntu0.1~esm1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
fantasy-fql/ESAPI-SQLinjection-CVE-2025-5878-Exploit ★ 0 · Jun 8, 2026
针对ESAPI 的ESAPI.encoder().encodeForSQL()方法，OracleCodec对象的sql 时间盲注利用
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- DLA-4246-1 libowasp-esapi-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2026-0273 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 3, 2026
- WID-SEC-2025-2353 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2025
References
- VDB-314321 | ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special element vdb-entry technical-description
- VDB-314321 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #590149 | ESAPI esapi-java-legacy 2.6.2.0 SQL injection filtering bypass1 third-party-advisory
- Submit #590150 | ESAPI esapi-java-legacy 2.6.2.0 SQL injection filtering bypass2 (Duplicate) third-party-advisory
- https://github.com/uglory-gll/javasec/blob/main/ESAPI.md related
- https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin13.pdf related
- https://github.com/ESAPI/esapi-java-legacy/commit/f75ac2c2647a81d2cfbdc9c899f8719c240ed512 patch
- https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.7.0.0 patch
- https://github.com/ESAPI/esapi-java-legacy/commit/e2322914304d9b1c52523ff24be495b7832f6a56 patch