CVE catalog

CVE-2019-10219

libhibernate-validator-java: CVE-2019-10219

Severity: Medium · CVSS 6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published: Aug 28, 2019, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.16% · Oct 25, 2026

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libhibernate-validator-java	sid	`5.3.6-3`	vulnerable
Debian	libhibernate-validator-java	forky	`5.3.6-3`	vulnerable
Debian	libhibernate-validator-java	trixie	`5.3.6-3`	vulnerable
Debian	libhibernate-validator-java	bookworm	`5.3.6-2`	vulnerable
Debian	libhibernate-validator4-java	sid	`4.3.4-7`	not affected
Debian	libhibernate-validator4-java	forky	`4.3.4-7`	not affected
Debian	libhibernate-validator4-java	trixie	`4.3.4-7`	not affected
Debian	libhibernate-validator4-java	bookworm	`4.3.4-7`	not affected
Cpe	hibernate_validator	Not reported	Not reported	unknown
Cpe	fuse	Not reported	Not reported	unknown
Cpe	jboss_data_grid	Not reported	Not reported	unknown
Cpe	jboss_enterprise_application_platform	Not reported	Not reported	unknown
Cpe	openshift_application_runtimes	Not reported	Not reported	unknown
Cpe	single_sign-on	Not reported	Not reported	unknown
Cpe	active_iq_unified_manager	Not reported	Not reported	unknown
Cpe	management_services_for_element_software_and_netapp_hci	Not reported	Not reported	unknown
Cpe	snapcenter_plug-in	Not reported	Not reported	unknown
Cpe	element	Not reported	Not reported	unknown

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libhibernate-validator-java	source	sid	`(unfixed)`	not yet assigned	Not reported	[948235]
Debian	libhibernate-validator-java	source	forky	`(unfixed)`	not yet assigned	Not reported	[948235]
Debian	libhibernate-validator-java	source	trixie	`(unfixed)`	not yet assigned	Not reported	[948235]
Debian	libhibernate-validator-java	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[948235]
Debian	libhibernate-validator4-java	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	libhibernate-validator4-java	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	libhibernate-validator4-java	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	libhibernate-validator4-java	source	bookworm	`Not affected`	unimportant	Not reported	Not reported

[Debian bug #948235]

Notes

[trixie] libhibernate-validator-java: Minor issue [bookworm] libhibernate-validator-java: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libhibernate-validator-java]Affected
Details (2)
- 5.3.6-2 · all · bookworm
  Affected
  dsa · libhibernate-validator-java · debian · bookworm; dsa · libhibernate-validator-java · debian · 12
- 5.3.6-2 · all · bookworm
  Affected
  dsa · libhibernate-validator-java · debian · bookworm; dsa · libhibernate-validator-java · debian · 12
[libhibernate-validator4-java]Not affected
Details (2)
- 4.3.4-7 · all · bookworm
  Not affected
  dsa · libhibernate-validator4-java · debian · bookworm
- 4.3.4-7 · all · bookworm
  Not affected
  dsa · libhibernate-validator4-java · debian · bookworm

[Debian 13 (Trixie)]

[libhibernate-validator-java]Affected
Details (2)
- 5.3.6-3 · all · trixie
  Affected
  dsa · libhibernate-validator-java · debian · 13
- 5.3.6-3 · all · trixie
  Affected
  dsa · libhibernate-validator-java · debian · 13

Observed: Oct 23, 2026, 5:38:23 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]