How do I check whether I am affected by CVE-2026-93879?

1. Find the version: mvn dependency:tree | grep hibernate-validator (or gradle dependencies). Vulnerable: >=5.4.1 <6.2.6, 7.0.0.Alpha1-<7.0.6, 8.0.0.Alpha1-<8.0.6, 9.0.0.Beta2-<9.0.2, 9.1.0.Alpha1-<9.1.5. 2. Search your code for addMessageParameter( in custom ConstraintValidators fed by user-controlled values, and for @UniqueElements(message = "...{duplicates}..."). 3. Check an EL implementation (org.glassfish.expressly:expressly or container-provided) is on the classpath; without one the flaw is not reachable. 4. On 5.4-6.1, EL is on for all messages by default; on newer versions only when the message references the parameter or enableExpressionLanguage() is called.

What is the fix for CVE-2026-93879?

Upgrade hibernate-validator to 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final or 9.1.5.Final (or later) on your release line. Workaround: in custom validators use addExpressionVariable instead of addMessageParameter for user-controlled values.

Post Share

HIGH7.5CVSS · psirt@us.ibm.com

NO KNOWN
EXPLOIT

ORG.HIBERNATE.VALIDATOR:HIBERNATE-VALIDATOR · CVE-2026-93879 · Package

Hibernate Validator: user input passed to addMessageParameter or @UniqueElements messages is evaluated as Expression Language

Q: What is the fix for CVE-2026-93879?

Upgrade hibernate-validator to 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final or 9.1.5.Final (or later) on your release line. Workaround: in custom validators use addExpressionVariable instead of addMessageParameter for user-controlled values.

Q: Who is not affected by CVE-2026-93879?

Not affected if: default-config, no-custom-validators, no-el-implementation.

FIX → 9.1.5.Final · 8.0.6.Final · 7.0.6.Final · 6.2.6.Final +1 ✓ verified

Hibernate Validator's HibernateConstraintValidatorContext#addMessageParameter (and the built-in @UniqueElements with a custom message) inserts the value unescaped before EL interpolation. User-controlled values containing EL are evaluated. NVD/IBM rate it as denial of service (CVSS 7.5); the maintainer advisory also says it can lead to information disclosure, and to remote code execution when the BEAN_METHODS EL level is enabled. Workaround from the maintainer: use addExpressionVariable instead of addMessageParameter for user-controlled values.

Full story ↓Less ↑

first public Nov 8, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

✓ Verified Nov 8

Java apps using Hibernate Validator (Spring Boot, Quarkus, Jakarta EE) are exposed only if a custom validator calls addMessageParameter with user-controlled data, or uses @UniqueElements with a custom message referencing {duplicates}, AND EL interpolation is on for that message AND an EL implementation is on the classpath. Apps that only use standard built-in constraints with default messages, or that use addExpressionVariable instead, can skip it. IBM lists WebSphere Application Server Liberty (bundled Hibernate Validator 9.1.3.Final) as affected.

org.hibernate.validator:hibernate-validator>=5.4.1, <6.2.6.Final; >=7.0.0.Alpha1, <7.0.6.Final; >=8.0.0.Alpha1, <8.0.6.Final; >=9.0.0.Beta2, <9.0.2.Final; >=9.1.0.Alpha1, <9.1.5.Finalfixed in 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final, 9.1.5.Final

Not affected if default-config, no-custom-validators, no-el-implementation

Who cares custom-validator, hibernate-validator, jakarta-bean-validation, java, maven, websphere-liberty

02 · How to check

✓ Verified Nov 8

Find the version: mvn dependency:tree | grep hibernate-validator (or gradle dependencies). Vulnerable: >=5.4.1 <6.2.6, 7.0.0.Alpha1-<7.0.6, 8.0.0.Alpha1-<8.0.6, 9.0.0.Beta2-<9.0.2, 9.1.0.Alpha1-<9.1.5.
Search your code for addMessageParameter( in custom ConstraintValidators fed by user-controlled values, and for @UniqueElements(message = "...{duplicates}...").

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 8, 2026

How it unfolded

2 events · Nov 8, 2026 → Nov 8, 2026

Nov 8, 202619:22 UTCNVD CVE-2026-93879
Nov 8, 202619:24 UTCInfraStack Analyst Read maintainer GHSA-gv36-fx3r-29p5 and IBM bulletin. Advisory describes EL injection (info disclosure/RCE with BEAN_METHODS) while NVD says DoS; exploitation conditions narrow. No exploitation or PoC found. Debian lists unfixed (minor). Did not check social.moreless

What the sources say, verbatim

217 characters

Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions.

Sources and references

NVD: CVE-2026-93879Nov 8, 2026
GHSA-gv36-fx3r-29p5: EL injection with addMessageParameter or @UniqueElementsAdvisory · github.com
IBM bulletin: Hibernate Validator EL injection CVE-2026-93879Mentions it · ibm.com
Hibernate Validator releasesFix · hibernate.org

This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

. Posts quoted belong to their authors.

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Org.hibernate.validator:hibernate-validator threat the day it hits your stack.

Start free

Post Share

HIGH7.5CVSS · psirt@us.ibm.com

NO KNOWN
EXPLOIT

ORG.HIBERNATE.VALIDATOR:HIBERNATE-VALIDATOR · CVE-2026-93879 · Package

Hibernate Validator: user input passed to addMessageParameter or @UniqueElements messages is evaluated as Expression Language

FIX → 9.1.5.Final · 8.0.6.Final · 7.0.6.Final · 6.2.6.Final +1 ✓ verified

Full story ↓Less ↑

first public Nov 8, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

✓ Verified Nov 8

org.hibernate.validator:hibernate-validator>=5.4.1, <6.2.6.Final; >=7.0.0.Alpha1, <7.0.6.Final; >=8.0.0.Alpha1, <8.0.6.Final; >=9.0.0.Beta2, <9.0.2.Final; >=9.1.0.Alpha1, <9.1.5.Finalfixed in 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final, 9.1.5.Final

Not affected if default-config, no-custom-validators, no-el-implementation

Who cares custom-validator, hibernate-validator, jakarta-bean-validation, java, maven, websphere-liberty

02 · How to check

✓ Verified Nov 8

Find the version: mvn dependency:tree | grep hibernate-validator (or gradle dependencies). Vulnerable: >=5.4.1 <6.2.6, 7.0.0.Alpha1-<7.0.6, 8.0.0.Alpha1-<8.0.6, 9.0.0.Beta2-<9.0.2, 9.1.0.Alpha1-<9.1.5.
Search your code for addMessageParameter( in custom ConstraintValidators fed by user-controlled values, and for @UniqueElements(message = "...{duplicates}...").

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 8, 2026

How it unfolded

2 events · Nov 8, 2026 → Nov 8, 2026

Nov 8, 202619:22 UTCNVD CVE-2026-93879
Nov 8, 202619:24 UTCInfraStack Analyst Read maintainer GHSA-gv36-fx3r-29p5 and IBM bulletin. Advisory describes EL injection (info disclosure/RCE with BEAN_METHODS) while NVD says DoS; exploitation conditions narrow. No exploitation or PoC found. Debian lists unfixed (minor). Did not check social.moreless

What the sources say, verbatim

217 characters

Sources and references

NVD: CVE-2026-93879Nov 8, 2026
GHSA-gv36-fx3r-29p5: EL injection with addMessageParameter or @UniqueElementsAdvisory · github.com
IBM bulletin: Hibernate Validator EL injection CVE-2026-93879Mentions it · ibm.com
Hibernate Validator releasesFix · hibernate.org

This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

. Posts quoted belong to their authors.

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Org.hibernate.validator:hibernate-validator threat the day it hits your stack.

Start free

Hibernate Validator: user input passed to addMessageParameter or @UniqueElements messages is evaluated as Expression Language

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Org.hibernate.validator:hibernate-validator threat the day it hits your stack.

Hibernate Validator: user input passed to addMessageParameter or @UniqueElements messages is evaluated as Expression Language

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Org.hibernate.validator:hibernate-validator threat the day it hits your stack.

03 · The fix