7.3

CVE-2025-35036: hibernate-validator insecure default Expression Language interpolation

Analyzed
AliasesUBUNTU-CVE-2025-35036DEBIAN-CVE-2025-35036GHSA-7v6m-28jr-rg84
Published 03-06-2025Last modified 05-06-2025

Vulnerability summary

CVE-2025-35036 is a high (CVSS 7.3) Improper Control of Generation of Code vulnerability in hibernate hibernate validator. EPSS estimates a 0.78% chance of exploitation in the next 30 days, higher than 56% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 6.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.3/10
010
High · v3.1 (CVE.org)
EPSS score
0.78%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3
RHSA-2025:10924RHSA-2025:10925RHSA-2025:10926

Timeline

  1. 03-06-2025
    PublishedVulnerability first disclosed.
  2. 05-06-2025
    Last modifiedVulnerability information updated.

Description

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.

CVSS metrics

9 scores · 5 sources · 2 versions

EPSS trend

Probability

0.78%

Chance of exploitation in the next 30 days

Percentile

56%

Versus all other CVEs

30-day change

Increase +0.03 pp

From 0.75% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Debian2 products
  • libhibernate-validator-javaAll versions (No fix recorded)
  • libhibernate-validator4-javaAll versions (No fix recorded)
Ubuntu2 products
  • libhibernate-validator-javaAll versions (No fix recorded)
  • libhibernate-validator4-javaAll versions (No fix recorded)
Hibernate1 product
Org.hibernate1 product
  • hibernate-validator< 6.2.0.CR1 | ≥ 7.0.0.Alpha1, < 7.0.0.CR1
Org.hibernate.validator1 product
  • hibernate-validator< 6.2.0.CR1 | ≥ 7.0.0.Alpha1, < 7.0.0.CR1
Redhat1 product

6 vendors · 8 products

References

19 links
Show all 19 references