org.hibernate:hibernate-validator-cdi (5.1.0.beta1) potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.1.0.beta1)

org.hibernate:hibernate-validator MAVEN version 5.1.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - org.hibernate:hibernate-validator-cdi 5.1.0.beta1 Source cves: CVE-2025-35036 Source...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +12212 more potentially affected by CVE-2020-5245 +1 more via org.hibernate.validator:hibernate-validator (>=6.0.0.alpha1, <=6.1.7.final)

org.hibernate.validator:hibernate-validator MAVEN version =6.0.0.alpha1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =j8.2.2.0, =finchley.sr2.sr1, =finchley.sr4, =2.1.0 and more Source cves: CVE-2020-5245, CVE-2025-35036 Source advisory:...

br.com.caelum.vraptor:vraptor-test (>=2.0.0, <=4.1.0), br.com.caelum:vraptor-musicjungle (4.0.0-beta-1) +227 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.0.1.final)

org.hibernate:hibernate-validator MAVEN version 5.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - br.com.caelum.vraptor:vraptor-test =2.0.0, =0.0.11, =0.2.3, =0.2.8, =0.2.8, =0.2.8,...

com.codingrodent.jackson.crypto:jackson-json-crypto (0.1.0), com.codingrodent:jackson-json-crypto (>=1.0.0, <=1.1.0) +91 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.3.0.final)

org.hibernate:hibernate-validator MAVEN version 5.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - com.codingrodent.jackson.crypto:jackson-json-crypto 0.1.0 -...

am.ik.home:uaa-server (>=1.3.0, <=1.9.0), au.com.cybernostics:theme-tree (0.9.0) +756 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.3.4.final)

org.hibernate:hibernate-validator MAVEN version 5.3.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - am.ik.home:uaa-server =1.3.0, =0.2.0, =1.0.3, =1.0.6, =0.2.1, =6.2.0.5, =6.2.0.6,...

org.jasig.cas:cas-server-webapp (3.4-rc1), org.jasig.openregistry:openregistry-repository-jpa-impl (>=0.1-m3.1, <=0.1-m4) +3 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (4.0.1.ga)

org.hibernate:hibernate-validator MAVEN version 4.0.1.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - org.jasig.cas:cas-server-webapp 3.4-rc1 -...

CVE-2025-35036

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as ...

DEBIAN-CVE-2025-35036

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as ...

UBUNTU-CVE-2025-35036

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as ...

br.com.thiaguten:umbrella-configuration (>=0.1.0, <=1.0.0), br.com.thiaguten:umbrella-core (>=0.1.0, <=1.0.0) +1272 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (>=6.0.0.beta2, <=6.1.7.final)

org.hibernate:hibernate-validator MAVEN version =6.0.0.beta2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.3.2-beta.6, =2.3.2-beta.5, =1.0.0, =1.1.16 - cn.openjava:openjava-spring-boot-starter 1.0.1 - cn.springcloud.gray:spring-cloud-gray-server d.0.1.0-beta-3 -...

com.github.jinahya:jsonrpc-bind-tests (0.7.1), org.amebastack.container:ameba-container-grizzly (>=0.1.6c, <=0.1.6e) +185 more potentially affected by CVE-2025-35036 via org.hibernate.validator:hibernate-validator (>=7.0.0.alpha1, <=7.0.0.alpha6)

org.hibernate.validator:hibernate-validator MAVEN version =7.0.0.alpha1, =0.1.6c, =0.1.2, =0.1.2, =0.1.2, =0.1.6c, =3.0.0-m2, =3.0.0-m2, =3.0.0-m2, =3.0.0-m2, =3.0.0 and more Source cves: CVE-2025-35036 Source advisory: SNYK:JAVA-ORGHIBERNATEVALIDATOR-10300773...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +12212 more potentially affected by CVE-2025-35036 via org.hibernate.validator:hibernate-validator (>=6.0.0.alpha1, <=6.1.7.final)

org.hibernate.validator:hibernate-validator MAVEN version =6.0.0.alpha1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =j8.2.2.0, =finchley.sr2.sr1, =finchley.sr4, =2.1.0 and more Source cves: CVE-2025-35036 Source advisory:...

Arbitrary Code Injection

Overview org.hibernate:hibernate-validator is a Hibernate Validator Engine Relocation Artifact. Affected versions of this package are vulnerable to Arbitrary Code Injection due to the interpolation of user-supplied input in constraint violation messages with Expression Language. An attacker can...

Arbitrary Code Injection

Overview org.hibernate.validator:hibernate-validator is a Hibernate Validator Engine Relocation Artifact. Affected versions of this package are vulnerable to Arbitrary Code Injection due to the interpolation of user-supplied input in constraint violation messages with Expression Language. An...

CVE-2025-35036

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as ...

CVE-2025-35036 hibernate-validator insecure default Expression Language interpolation

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as ...

ai.grakn.kgms:client (1.4.3), ai.grakn:client-java (>=1.4.1, <=1.4.3) +9891 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (>=3.0.0.ga, <=6.1.7.final)

org.hibernate:hibernate-validator MAVEN version =3.0.0.ga, =1.4.1, =0.13.0, =0.13.0, =0.13.0, =0.13.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =0.13.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =0.13.0, =0.13.0, =0.13.0, =1.4.1, =0.13.0, =0.13.0, =0.14.0 and more Sourc...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +12212 more potentially affected by CVE-2025-35036 via org.hibernate.validator:hibernate-validator (>=6.0.0.alpha1, <=6.1.7.final)

org.hibernate.validator:hibernate-validator MAVEN version =6.0.0.alpha1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =j8.2.2.0, =finchley.sr2.sr1, =finchley.sr4, =2.1.0 and more Source cves: CVE-2025-35036 Source advisory: MEND:CVE-2025-35...

com.github.jinahya:jsonrpc-bind-tests (0.7.1), org.amebastack.container:ameba-container-grizzly (>=0.1.6c, <=0.1.6e) +185 more potentially affected by CVE-2025-35036 via org.hibernate.validator:hibernate-validator (>=7.0.0.alpha1, <=7.0.0.alpha6)

org.hibernate.validator:hibernate-validator MAVEN version =7.0.0.alpha1, =0.1.6c, =0.1.2, =0.1.2, =0.1.2, =0.1.6c, =3.0.0-m2, =3.0.0-m2, =3.0.0-m2, =3.0.0-m2, =3.0.0 and more Source cves: CVE-2025-35036 Source advisory: MEND:CVE-2025-35036...

CVE-2025-35036

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as ...