---
id: "CVE-2026-93879"
page: "https://infrastack.ai/live/CVE-2026-93879"
kind: "vulnerability"
aliases: ["CVE-2026-93879"]
title: "Hibernate Validator: user input passed to addMessageParameter or @UniqueElements messages is evaluated as Expression Language"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "org.hibernate.validator:hibernate-validator", "fixed": ["6.2.6.Final", "7.0.6.Final", "8.0.6.Final", "9.0.2.Final", "9.1.5.Final"], "affected": ">=5.4.1, <6.2.6.Final; >=7.0.0.Alpha1, <7.0.6.Final; >=8.0.0.Alpha1, <8.0.6.Final; >=9.0.0.Beta2, <9.0.2.Final; >=9.1.0.Alpha1, <9.1.5.Final", "ecosystem": "maven"}]
ecosystems: []
tags: ["custom-validator", "hibernate-validator", "jakarta-bean-validation", "java", "maven", "package", "websphere-liberty"]
not_affected_if: ["default-config", "no-custom-validators", "no-el-implementation"]
published_at: "2026-11-08T19:17:43+00:00"
first_seen_at: "2026-11-08T19:22:35+00:00"
updated_at: "2026-11-08T19:24:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93879", "first_seen_at": "2026-11-08T19:22:35+00:00"}, {"source": "analyst", "url": "https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5", "first_seen_at": "2026-11-08T19:24:02+00:00", "cites": ["https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5", "https://hibernate.org/validator/releases/", "https://www.ibm.com/support/pages/security-bulletin-hibernate-validator-affected-expression-language-injection-vulnerability-cve-2026-93879"]}]
exploit_sources: []
---

# Hibernate Validator: user input passed to addMessageParameter or @UniqueElements messages is evaluated as Expression Language

Link for people: https://infrastack.ai/live/CVE-2026-93879 (this .md is for agents)

Hibernate Validator's HibernateConstraintValidatorContext#addMessageParameter (and the built-in @UniqueElements with a custom message) inserts the value unescaped before EL interpolation. User-controlled values containing EL are evaluated. NVD/IBM rate it as denial of service (CVSS 7.5); the maintainer advisory also says it can lead to information disclosure, and to remote code execution when the BEAN_METHODS EL level is enabled. Workaround from the maintainer: use addExpressionVariable instead of addMessageParameter for user-controlled values.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.hibernate.validator:hibernate-validator affected >=5.4.1, <6.2.6.Final; >=7.0.0.Alpha1, <7.0.6.Final; >=8.0.0.Alpha1, <8.0.6.Final; >=9.0.0.Beta2, <9.0.2.Final; >=9.1.0.Alpha1, <9.1.5.Final fixed 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final, 9.1.5.Final

## How to check

1. Find the version: mvn dependency:tree | grep hibernate-validator (or gradle dependencies). Vulnerable: >=5.4.1 <6.2.6, 7.0.0.Alpha1-<7.0.6, 8.0.0.Alpha1-<8.0.6, 9.0.0.Beta2-<9.0.2, 9.1.0.Alpha1-<9.1.5.
2. Search your code for addMessageParameter( in custom ConstraintValidators fed by user-controlled values, and for @UniqueElements(message = "...{duplicates}...").
3. Check an EL implementation (org.glassfish.expressly:expressly or container-provided) is on the classpath; without one the flaw is not reachable.
4. On 5.4-6.1, EL is on for all messages by default; on newer versions only when the message references the parameter or enableExpressionLanguage() is called.

## Fix

Upgrade hibernate-validator to 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final or 9.1.5.Final (or later) on your release line. Workaround: in custom validators use addExpressionVariable instead of addMessageParameter for user-controlled values.

## Timeline

- 2026-11-08T19:22:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93879
- 2026-11-08T19:24:02+00:00 analyst https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5 — Read maintainer GHSA-gv36-fx3r-29p5 and IBM bulletin. Advisory describes EL injection (info disclosure/RCE with BEAN_METHODS) while NVD says DoS; exploitation conditions narrow. No exploitation or PoC found. Debian lists unfixed (minor). Did not check social.

## Documents

- [advisory] GHSA-gv36-fx3r-29p5: EL injection with addMessageParameter or @UniqueElements https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5
- [fix] Hibernate Validator releases https://hibernate.org/validator/releases/
- [mentions] IBM bulletin: Hibernate Validator EL injection CVE-2026-93879 https://www.ibm.com/support/pages/security-bulletin-hibernate-validator-affected-expression-language-injection-vulnerability-cve-2026-93879

## From the sources

Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_