U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. Vulnerabilities

CVE-2025-35036 Detail

Description

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.

Nist CVSS score does not match with CNA score
CNA:  Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
CVSS-B 6.9 MEDIUM
Vector:  CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/#section-hibernateconstraintvalidatorcontext Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government Product 
https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government Patch 
https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government Patch 
https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government Patch 
https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government Patch 
https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government Release Notes 
https://github.com/hibernate/hibernate-validator/pull/1138 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government Issue Tracking 
https://hibernate.atlassian.net/browse/HV-1816 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government Issue Tracking 
https://hibernate.org/validator/documentation/migration-guide/#6-2-0-cr1 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government Release Notes 
https://in.relation.to/2021/01/06/hibernate-validator-700-62-final-released/#expression-language Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government Release Notes 
https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/ Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government Not Applicable 
https://www.cve.org/CVERecord?id=CVE-2020-5245 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government Not Applicable 
https://www.cve.org/CVERecord?id=CVE-2025-4428 Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government Not Applicable 

Weakness Enumeration

CWE-ID CWE Name Source
CWE-94 Improper Control of Generation of Code ('Code Injection') Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government  

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2025-35036
NVD Published Date:
06/03/2025
NVD Last Modified:
09/18/2025
Source:
Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government