CVE catalog

CVE-2025-35036

libhibernate-validator-java: CVE-2025-35036

[CVE catalog]

Severity
High · CVSS 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.75% · Oct 25, 2026

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibhibernate-validator-javasid5.3.6-3vulnerable
Debianlibhibernate-validator-javaforky5.3.6-3vulnerable
Debianlibhibernate-validator-javatrixie5.3.6-3vulnerable
Debianlibhibernate-validator-javabookworm5.3.6-2vulnerable
Debianlibhibernate-validator4-javasid4.3.4-7vulnerable
Debianlibhibernate-validator4-javaforky4.3.4-7vulnerable
Debianlibhibernate-validator4-javatrixie4.3.4-7vulnerable
Debianlibhibernate-validator4-javabookworm4.3.4-7vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibhibernate-validator-javasourcesid(unfixed)not yet assignedNot reported[1107517]
Debianlibhibernate-validator-javasourceforky(unfixed)not yet assignedNot reported[1107517]
Debianlibhibernate-validator-javasourcetrixie(unfixed)not yet assignedNot reported[1107517]
Debianlibhibernate-validator-javasourcebookworm(unfixed)not yet assignedNot reported[1107517]
Debianlibhibernate-validator4-javasourcesid(unfixed)not yet assignedNot reported[1107518]
Debianlibhibernate-validator4-javasourceforky(unfixed)not yet assignedNot reported[1107518]
Debianlibhibernate-validator4-javasourcetrixie(unfixed)not yet assignedNot reported[1107518]
Debianlibhibernate-validator4-javasourcebookworm(unfixed)not yet assignedNot reported[1107518]

[Debian bug #1107517][Debian bug #1107518]

Notes

[trixie] libhibernate-validator-java: Minor issue, only changes the default behaviour, no security issue by itself [bookworm] libhibernate-validator-java: Minor issue, only changes the default behaviour, no security issue by itself [trixie] libhibernate-validator4-java: Minor issue, only changes the default behaviour, no security issue by itself [bookworm] libhibernate-validator4-java: Minor issue, only changes the default behaviour, no security issue by itself

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libhibernate-validator4-java]Affected
    Details (2)

    • 4.3.4-7 · all · bookworm

      Affected

      dsa · libhibernate-validator4-java · debian · bookworm; dsa · libhibernate-validator4-java · debian · 12

    • 4.3.4-7 · all · bookworm

      Affected

      dsa · libhibernate-validator4-java · debian · bookworm; dsa · libhibernate-validator4-java · debian · 12

  • [libhibernate-validator-java]Affected
    Details (2)

    • 5.3.6-2 · all · bookworm

      Affected

      dsa · libhibernate-validator-java · debian · bookworm; dsa · libhibernate-validator-java · debian · 12

    • 5.3.6-2 · all · bookworm

      Affected

      dsa · libhibernate-validator-java · debian · bookworm; dsa · libhibernate-validator-java · debian · 12

[Debian 13 (Trixie)]

  • [libhibernate-validator4-java]Affected
    Details (2)

    • 4.3.4-7 · all · trixie

      Affected

      dsa · libhibernate-validator4-java · debian · 13

    • 4.3.4-7 · all · trixie

      Affected

      dsa · libhibernate-validator4-java · debian · 13

  • [libhibernate-validator-java]Affected
    Details (2)

    • 5.3.6-3 · all · trixie

      Affected

      dsa · libhibernate-validator-java · debian · 13

    • 5.3.6-3 · all · trixie

      Affected

      dsa · libhibernate-validator-java · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]