Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language

The core of this vulnerability lies in Hibernate Validator's default behavior of interpolating user-supplied input within custom constraint violation messages using Expression Language (EL). An attacker can craft malicious input that, when processed by Hibernate Validator, results in the execution of arbitrary code or the exposure of sensitive information. This could involve accessing environment variables, system properties, or even executing commands on the underlying server. The potential impact is significant, particularly in applications that rely heavily on Hibernate Validator for data validation and where user input is directly incorporated into error messages. This vulnerability shares similarities with CVE-2020-5245 and other related vulnerabilities involving EL interpolation, highlighting the importance of careful input validation and secure configuration.

Applications utilizing Hibernate Validator for data validation, particularly those that allow user-supplied input to be incorporated into constraint violation messages, are at risk. This includes web applications, REST APIs, and any Java-based system relying on Hibernate Validator for input sanitization. Legacy applications using older versions of Hibernate Validator are particularly vulnerable.

• java / server:

# Check for vulnerable versions of Hibernate Validator in dependencies
find . -name pom.xml -o -name build.gradle | xargs grep 'org.hibernate.validator:hibernate-validator:"[<=6.1.7.Final]"'

• java / application:

// Inspect the Hibernate Validator version at runtime
String validatorVersion = ValidatorFactory.class.getPackage().getImplementationVersion();
System.out.println("Hibernate Validator Version: " + validatorVersion);

1. 2025-06-03Disclosure

   disclosure

1. Gereserveerd2025-04-15
2. Gepubliceerd2025-06-03
3. Gewijzigd2025-09-12
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-35036 is to upgrade to Hibernate Validator version 6.2.0.CR1 or later. These versions have disabled the default EL interpolation behavior in constraint violation messages. If upgrading is not immediately feasible, consider implementing input validation to sanitize user-supplied data before it is used in constraint violation messages. Furthermore, avoid allowing user-supplied input directly within constraint violation messages. While not a direct fix, configuring Hibernate Validator to not interpolate user input can significantly reduce the attack surface. After upgrading, confirm the fix by attempting to inject EL expressions into validation messages and verifying that they are not processed.