PT-2025-23663 · Hibernate+5 · Hibernate Validator+4

Published 2025-06-03 · Updated 2025-07-01 · CVE-2025-35036

X.com · Cvenew

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVE-2025-35036 Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expres… https://t.co/002YgA2hEa

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-35036

GHSA-7V6M-28JR-RG84

RHSA-2025:10924

RHSA-2025:10925

RHSA-2025:10926

Affected Products

Hibernate Validator

Libhibernate-Validator-Java

Libhibernate-Validator4-Java

Org.Hibernate.Validator:Hibernate-Validator

Org.Hibernate:Hibernate-Validator

References · 26

• https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1 · Patch
• https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78 · Patch
• https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e · Patch
• https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-35036 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-35036 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-35036 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-35036 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7v6m-28jr-rg84 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-4428 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-35036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-35036 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-5245 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-35036 · Security Note
• https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final · Note