Hibernate Validator <=6.2.0/7.0.0 EL Injection in Violation Messages
CVE-2025-35036 Published on June 3, 2025
hibernate-validator insecure default Expression Language interpolation
Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.
Vulnerability Analysis
CVE-2025-35036 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2025-35036. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.
Weakness Type
What is a Code Injection Vulnerability?
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVE-2025-35036 has been classified to as a Code Injection vulnerability or weakness.
Products Associated with CVE-2025-35036
Want to know whenever a new CVE is published for Oracle? stack.watch will email you.
Affected Versions
Hibernate Validator:- Before 6.2.0 is affected.
- Before 7.0.0 is affected.
- Version 6.2.0 is unaffected.
- Version 7.0.0 is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.