CVE-2026-93879

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Oct 12, 2026, 4:18:43 PM UTC

Source

[NVD] · [CVE record]

A flaw was found in Hibernate Validator starting with version 5.4.1. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by submitting specially crafted input containing unescaped message parameters. Improper escaping allows user-supplied data to be re-evaluated during Expression Language (EL) processing, leading to excessive resource consumption and application unresponsiveness. org.hibernate.validator:hibernate-validator: Hibernate Validator - unescaped {duplicates} message parameter is re-evaluated as Expression Language (unauthenticated DoS) Red Hat Product Security rates this vulnerability as Moderate because it enables a denial of service through resource exhaustion without compromising data integrity or confidentiality. Applications utilizing Hibernate Validator to process untrusted input may experience thread starvation or high CPU usage when validation message templates re-evaluate duplicate parameters via the expression language engine. Exploitation requires submitting tailored payloads to application endpoints performing Bean Validation, but it cannot be leveraged to achieve code execution or data leakage in typical deployments. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.