Hibernate Validator < 6.2 / 7.0 Arbitrary RCE

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as ...

Expired Pointer Dereference

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Expired Pointer Dereference via 'xmlSchematronGetNode function in Schematron validator. An attacker can cause a crash or execute arbitrary code by triggering use of freed memory...

Arbitrary Code Injection

org.hibernate.validator:hibernate-validator is vulnerable to Arbitrary Code Injection. The vulnerability is due to expression language injection due to interpolation of user-supplied input in constraint violation messages using Expression Language, which may allow attackers to access sensitive da...

Unraveling Ethereum'S Mempool: the Impact of Fee Fairness, Transaction Prioritization, and Consensus Efficiency

Ethereum's transaction pool mempool dynamics and fee market efficiency critically affect transaction inclusion, validator workload, and overall network performance. This research empirically analyzes gas price variations, mempool clearance rates, and block finalization times in Ethereum's...

com.github.arucard21.simplyrestful:deploy-jetty-cxf (>=0.9.0, <=0.12.2), com.github.arucard21.simplyrestful:simplyrestful-cxf (>=0.7, <=0.8.0) +115 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.4.0.final)

org.hibernate:hibernate-validator MAVEN version 5.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - com.github.arucard21.simplyrestful:deploy-jetty-cxf =0.9.0, =0.7, =0.2, =0.0.5, =0.30.0...

com.jcabi:jcabi-aspects (>=0.7.9, <=0.7.13), com.jcabi:jcabi-heroku-maven-plugin (>=0.7.9, <=0.7.13) +5 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.0.0.cr1)

org.hibernate:hibernate-validator MAVEN version 5.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - com.jcabi:jcabi-aspects =0.7.9, =0.7.9, =2.0-m13-1, =2.0-m13-1, =2.0-m13-1, =2.0-m13-2...

com.jcabi:jcabi-mysql-maven-plugin (0.8.2), com.netbout:netbout-web (>=0.22.5, <=2.32) +5 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.2.0.alpha1)

org.hibernate:hibernate-validator MAVEN version 5.2.0.alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - com.jcabi:jcabi-mysql-maven-plugin 0.8.2 - com.netbout:netbout-web =0.22.5, =0.94,...

com.github.bingoohuang:quartz-glass (>=0.0.1, <=0.0.9), org.hibernate:hibernate-validator-annotation-processor (4.1.0.beta1) potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (4.1.0.beta1)

org.hibernate:hibernate-validator MAVEN version 4.1.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - com.github.bingoohuang:quartz-glass =0.0.1, =0.0.9 -...

cn.jiangzeyin.fast-boot:common-boot (>=1.1.12, <=1.2.39), cn.jiangzeyin.fast-boot:common-redis (>=1.1.12, <=1.2.39) +127 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.2.5.final)

org.hibernate:hibernate-validator MAVEN version 5.2.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - cn.jiangzeyin.fast-boot:common-boot =1.1.12, =1.1.12, =1.2.28, =1.1.2, =1.1.2, =1.0.0,...

com.github.mygreen:super-csv-annotation (>=2.0, <=2.0.3), com.kumuluz.ee:kumuluzee-bean-validation-hibernate-validator (>=2.1.0-beta.2, <=2.3.0-beta.1) +53 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.3.3.final)

org.hibernate:hibernate-validator MAVEN version 5.3.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - com.github.mygreen:super-csv-annotation =2.0, =2.1.0-beta.2, =0.22.0, =2.3.13, =2.3.78,...

org.glassfish.jersey.bundles.glassfish.v4_0:jersey-gfv4_0-core (2.0-rc1), org.glassfish.jersey.examples:bean-validation-webapp (2.0-rc1) +1 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.0.0.cr4)

org.hibernate:hibernate-validator MAVEN version 5.0.0.cr4 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - org.glassfish.jersey.bundles.glassfish.v40:jersey-gfv40-core 2.0-rc1 -...

biz.littlej.jreqs:jreqs-beanvalidation (0.1.2), br.com.caelum:vraptor-mydvds (>=3.5.0, <=3.5.5) +317 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (4.2.0.final)

org.hibernate:hibernate-validator MAVEN version 4.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - biz.littlej.jreqs:jreqs-beanvalidation 0.1.2 - br.com.caelum:vraptor-mydvds =3.5.0,...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +12207 more potentially affected by CVE-2025-35036 via org.hibernate.validator:hibernate-validator (>=6.0.0.alpha1, <=6.1.7.final)

org.hibernate.validator:hibernate-validator MAVEN version =6.0.0.alpha1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =j8.2.2.0, =finchley.sr2.sr1, =finchley.sr4, =2.1.0 and more Source cves: CVE-2025-35036 Source advisory:...

au.com.mountain-pass:hyperstate (>=1, <=3), be.fluid-it.microservice.bundle:microservice-bundle-core (>=0.1-6, <=0.1-16) +671 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.2.2.final)

org.hibernate:hibernate-validator MAVEN version 5.2.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - au.com.mountain-pass:hyperstate =1, =0.1-6, =0.1-6, =0.1-9, =0.1-6, =0.9-3-1, =1.0.1,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=3.8.0, <=4.2.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=4.1.0, <=4.2.0) +567 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.4.2.final)

org.hibernate:hibernate-validator MAVEN version 5.4.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =3.8.0, =4.1.0, =3.8.0, =3.8.0, =3.8.0, =4.0.0,...

au.org.consumerdatastandards:client-cli (>=0.9.6, <=2.4.1), biz.jovido:jovido-webseed (>=0.0.1, <=0.0.1-fenicesfa) +1260 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.3.5.final)

org.hibernate:hibernate-validator MAVEN version 5.3.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - au.org.consumerdatastandards:client-cli =0.9.6, =0.0.1, =0.2.13, =1.0.1, =1.2, =0.1,...

am.ik.home:uaa-server (>=1.0.0, <=1.2.0), au.com.mountain-pass:hyperstate (>=4, <=9) +2248 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.2.4.final)

org.hibernate:hibernate-validator MAVEN version 5.2.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - am.ik.home:uaa-server =1.0.0, =4, =1, =1, =1, =1, =1, =2.5.0, =2.0.0-snapshot, =2.0.0 -...

com.github.hermod:hermod-generator-maven-plugin (>=0.0.1, <=0.0.4), com.jcabi:jcabi-aspects (>=0.7.15, <=0.7.16) +9 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.0.0.cr3)

org.hibernate:hibernate-validator MAVEN version 5.0.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - com.github.hermod:hermod-generator-maven-plugin =0.0.1, =0.7.15, =0.7.15, =0.7.16 -...

com.github.edgarespina:mwa-jpa (>=0.1.7, <=0.2.7), com.github.edgarespina:mwa-morphia (>=0.1.7, <=0.2.7) +15 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.0.0.alpha1)

org.hibernate:hibernate-validator MAVEN version 5.0.0.alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - com.github.edgarespina:mwa-jpa =0.1.7, =0.1.7, =0.1.7, =0.3.0, =0.3.0, =0.3.8, =0.3.8,...

com.hack23.cia:service.data.impl (2017.1.21), com.hack23.cia:service.impl (2017.1.21) +1 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.4.0.cr1)

org.hibernate:hibernate-validator MAVEN version 5.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - com.hack23.cia:service.data.impl 2017.1.21 - com.hack23.cia:service.impl 2017.1.21 -...