CVE-2025-35036 hibernate-validator insecure default Expression Language interpolation
Attackers can execute arbitrary Java code or access sensitive data via Expression Language injection in Hibernate Validator constraint messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-35036?
CVE-2025-35036 is a medium-severity code injection vulnerability in Hibernate Validator, published on 3 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.
Weakness: CWE-94
Which versions are affected by CVE-2025-35036?
8 open source packages ship an affected version, including org.hibernate.validator:hibernate-validator and org.hibernate:hibernate-validator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.hibernate.validator:hibernate-validator Maven | All versions | 6.2.0.CR1 |
org.hibernate.validator:hibernate-validator Maven | All versions | 6.2.0.CR1 |
org.hibernate.validator:hibernate-validator Maven | From 7.0.0.Alpha1 | 7.0.0.CR1 |
org.hibernate.validator:hibernate-validator Maven | From 7.0.0.Alpha1 | 7.0.0.CR1 |
org.hibernate:hibernate-validator Maven | All versions | 6.2.0.CR1 |
org.hibernate:hibernate-validator Maven | All versions | 6.2.0.CR1 |
2 more packages
org.hibernate:hibernate-validator Maven | From 7.0.0.Alpha1 | 7.0.0.CR1 |
org.hibernate:hibernate-validator Maven | From 7.0.0.Alpha1 | 7.0.0.CR1 |
Products include Redhat Hibernate Validator.
How do I fix CVE-2025-35036?
Upgrade org.hibernate.validator:hibernate-validator to a fixed version for your release line: 6.2.0.CR1 or 7.0.0.CR1.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-35036 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-35036 exists.
Other vulnerabilities in Hibernate Validator
Sources
Also known as DEBIAN-CVE-2025-35036, GHSA-7v6m-28jr-rg84, UBUNTU-CVE-2025-35036.