{"id":"CVE-2026-93879","kind":"vulnerability","aliases":["CVE-2026-93879"],"related":[],"title":"Hibernate Validator: user input passed to addMessageParameter or @UniqueElements messages is evaluated as Expression Language","description":"Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions.","summary":"Hibernate Validator's HibernateConstraintValidatorContext#addMessageParameter (and the built-in @UniqueElements with a custom message) inserts the value unescaped before EL interpolation. User-controlled values containing EL are evaluated. NVD/IBM rate it as denial of service (CVSS 7.5); the maintainer advisory also says it can lead to information disclosure, and to remote code execution when the BEAN_METHODS EL level is enabled. Workaround from the maintainer: use addExpressionVariable instead of addMessageParameter for user-controlled values.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"org.hibernate.validator:hibernate-validator","fixed":["6.2.6.Final","7.0.6.Final","8.0.6.Final","9.0.2.Final","9.1.5.Final"],"affected":">=5.4.1, <6.2.6.Final; >=7.0.0.Alpha1, <7.0.6.Final; >=8.0.0.Alpha1, <8.0.6.Final; >=9.0.0.Beta2, <9.0.2.Final; >=9.1.0.Alpha1, <9.1.5.Final","ecosystem":"maven"}],"ecosystems":[],"tags":["custom-validator","hibernate-validator","jakarta-bean-validation","java","maven","package","websphere-liberty"],"not_affected_if":["default-config","no-custom-validators","no-el-implementation"],"how_to_check":"1. Find the version: mvn dependency:tree | grep hibernate-validator (or gradle dependencies). Vulnerable: >=5.4.1 <6.2.6, 7.0.0.Alpha1-<7.0.6, 8.0.0.Alpha1-<8.0.6, 9.0.0.Beta2-<9.0.2, 9.1.0.Alpha1-<9.1.5.\n2. Search your code for addMessageParameter( in custom ConstraintValidators fed by user-controlled values, and for @UniqueElements(message = \"...{duplicates}...\").\n3. Check an EL implementation (org.glassfish.expressly:expressly or container-provided) is on the classpath; without one the flaw is not reachable.\n4. On 5.4-6.1, EL is on for all messages by default; on newer versions only when the message references the parameter or enableExpressionLanguage() is called.","fix":"Upgrade hibernate-validator to 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final or 9.1.5.Final (or later) on your release line. Workaround: in custom validators use addExpressionVariable instead of addMessageParameter for user-controlled values.","status":"open","published_at":"2026-11-08T19:17:43+00:00","first_seen_at":"2026-11-08T19:22:35+00:00","triaged_at":"2026-11-08T19:23:10+00:00","updated_at":"2026-11-08T19:24:02+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-08T19:23:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Hibernate Validator: crafted Expression Language input lets a remote attacker exhaust resources","impact":"low","summary":"Hibernate Validator mishandles user-controlled data inside Expression Language expressions, causing uncontrolled resource consumption. A remote attacker can trigger a denial of service against an application that passes such data into validation messages.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","hibernate-validator","jakarta-bean-validation"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker exhausts server resources, causing denial of service","analyst_note":"Sources give only the NVD description; check the NVD and Hibernate Validator advisory for affected and fixed versions and whether user input reaches message interpolation by default.","how_to_check":"- Check the `hibernate-validator` version in the project's dependency file (Maven `pom.xml` or Gradle build file) or with `mvn dependency:tree | grep hibernate-validator`\n- Check whether user input reaches validation message interpolation","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000686,"input_tokens":4519,"output_tokens":468,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give only the NVD description; check the NVD and Hibernate Validator advisory for affected and fixed versions and whether user input reaches message interpolation by default.","search":"'-2026':17A,20A '-93879':18A,21A '7.5':80B 'addexpressionvari':110B 'addmessageparamet':7A,46B,113B 'advisori':83B 'allow':122C 'also':84B 'attack':125C 'bean':34B,99B 'built':50B 'built-in':49B 'caus':127C 'code':95B 'consumpt':136C 'contain':68B 'control':66B,117B,144C 'could':121C 'custom':27B,55B 'custom-valid':26B 'cve':16A,19A 'cvss':79B 'data':145C 'denial':76B,129C 'disclosur':91B 'due':132C 'el':62B,69B,101B,149C 'enabl':104B 'escap':140C 'evalu':12A,71B 'execut':96B 'express':14A,147C,150C 'hibern':1A,30B,42B,119C 'hibernate':24A 'hibernate-valid':29B 'hibernate-validator':23A 'hibernateconstraintvalidatorcontext':45B 'improp':139C 'inform':90B 'input':4A 'insert':57B 'instead':111B 'interpol':63B 'jakarta':33B 'jakarta-bean-valid':32B 'java':36B 'languag':15A,148C 'lead':88B 'level':102B 'liberti':41B 'maintain':82B,108B 'maven':37B 'messag':10A,56B 'method':100B 'nvd/ibm':72B 'org.hibernate.validator':22A 'packag':38B 'pass':5A 'rate':73B 'remot':94B,124C 'resourc':135C 'result':137C 'say':85B 'servic':78B,131C 'uncontrol':134C 'unescap':60B 'uniqueel':9A,52B 'use':109B 'user':3A,65B,116B,143C 'user-control':64B,115B,142C 'valid':2A,28B,31B,35B,43B,120C 'validator':25A 'valu':59B,67B,118B 'webspher':40B 'websphere-liberti':39B 'workaround':105B","nicknames":[],"mitigations":[],"who_affected":"Java apps using Hibernate Validator (Spring Boot, Quarkus, Jakarta EE) are exposed only if a custom validator calls addMessageParameter with user-controlled data, or uses @UniqueElements with a custom message referencing {duplicates}, AND EL interpolation is on for that message AND an EL implementation is on the classpath. Apps that only use standard built-in constraints with default messages, or that use addExpressionVariable instead, can skip it. IBM lists WebSphere Application Server Liberty (bundled Hibernate Validator 9.1.3.Final) as affected.","tier":"B","verified":{"fix":{"at":"2026-11-08T19:24:02Z","by":"analyst","doc":"https://hibernate.org/validator/releases/","run_id":2215},"products":{"at":"2026-11-08T19:24:02Z","by":"analyst","doc":"https://hibernate.org/validator/releases/","run_id":2215},"how_to_check":{"at":"2026-11-08T19:24:02Z","by":"analyst","doc":"https://hibernate.org/validator/releases/","run_id":2215},"who_affected":{"at":"2026-11-08T19:24:02Z","by":"analyst","doc":"https://hibernate.org/validator/releases/","run_id":2215}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["orghibernatevalidatorhibernatevalidator"],"ptokens":["hibernate","org","validator"],"labels":["customvalidator","hibernatevalidator","high","jakartabeanvalidation","java","maven","package","websphereliberty"],"campaign_type":null,"search_a":"'-2026':17A,20A '-93879':18A,21A 'addmessageparamet':7A 'cve':16A,19A 'evalu':12A 'express':14A 'hibern':1A 'hibernate':24A 'hibernate-validator':23A 'input':4A 'languag':15A 'messag':10A 'org.hibernate.validator':22A 'pass':5A 'uniqueel':9A 'user':3A 'valid':2A 'validator':25A","search_b":"'7.5':80B 'addexpressionvari':110B 'addmessageparamet':46B,113B 'advisori':83B 'also':84B 'bean':34B,99B 'built':50B 'built-in':49B 'code':95B 'contain':68B 'control':66B,117B 'custom':27B,55B 'custom-valid':26B 'cvss':79B 'denial':76B 'disclosur':91B 'el':62B,69B,101B 'enabl':104B 'evalu':71B 'execut':96B 'hibern':30B,42B 'hibernate-valid':29B 'hibernateconstraintvalidatorcontext':45B 'inform':90B 'insert':57B 'instead':111B 'interpol':63B 'jakarta':33B 'jakarta-bean-valid':32B 'java':36B 'lead':88B 'level':102B 'liberti':41B 'maintain':82B,108B 'maven':37B 'messag':56B 'method':100B 'nvd/ibm':72B 'packag':38B 'rate':73B 'remot':94B 'say':85B 'servic':78B 'unescap':60B 'uniqueel':52B 'use':109B 'user':65B,116B 'user-control':64B,115B 'valid':28B,31B,35B,43B 'valu':59B,67B,118B 'webspher':40B 'websphere-liberti':39B 'workaround':105B","search_c":"'allow':122C 'attack':125C 'caus':127C 'consumpt':136C 'control':144C 'could':121C 'data':145C 'denial':129C 'due':132C 'el':149C 'escap':140C 'express':147C,150C 'hibern':119C 'improp':139C 'languag':148C 'remot':124C 'resourc':135C 'result':137C 'servic':131C 'uncontrol':134C 'user':143C 'user-control':142C 'valid':120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T19:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93879","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93879","severity":null,"published_at":"2026-11-08T19:17:43+00:00","modified_at":"2026-11-08T19:17:43+00:00","first_seen_at":"2026-11-08T19:22:35+00:00","fetched_at":"2026-11-08T19:22:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93879:2215","url":"https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5","severity":null,"published_at":"2026-11-08T19:24:02+00:00","modified_at":"2026-11-08T19:24:02+00:00","first_seen_at":"2026-11-08T19:24:02+00:00","fetched_at":"2026-11-08T19:24:02+00:00","note":"Read maintainer GHSA-gv36-fx3r-29p5 and IBM bulletin. Advisory describes EL injection (info disclosure/RCE with BEAN_METHODS) while NVD says DoS; exploitation conditions narrow. No exploitation or PoC found. Debian lists unfixed (minor). Did not check social.","cites":["https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5","https://www.ibm.com/support/pages/security-bulletin-hibernate-validator-affected-expression-language-injection-vulnerability-cve-2026-93879","https://hibernate.org/validator/releases/"]}],"documents":[{"id":103195,"url":"https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5","title":"GHSA-gv36-fx3r-29p5: EL injection with addMessageParameter or @UniqueElements","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":103196,"url":"https://www.ibm.com/support/pages/security-bulletin-hibernate-validator-affected-expression-language-injection-vulnerability-cve-2026-93879","title":"IBM bulletin: Hibernate Validator EL injection CVE-2026-93879","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":103197,"url":"https://hibernate.org/validator/releases/","title":"Hibernate Validator releases","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}