{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93879", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-09-18T20:04:20.857Z", "datePublished": "2026-11-08T18:47:46.353Z", "dateUpdated": "2026-11-08T18:47:46.353Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T18:47:46.353Z"}, "title": "Hibernate Validator is affected by an expression language injection vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Hibernate Validator", "versions": [{"status": "affected", "version": "5.4.1.Final", "lessThanOrEqual": "6.2.5.Final", "versionType": "semver"}, {"status": "affected", "version": "7.0.0.Alpha1", "lessThanOrEqual": "7.0.5.Final", "versionType": "semver"}, {"status": "affected", "version": "8.0.0.Alpha1", "lessThanOrEqual": "8.0.5.Final", "versionType": "semver"}, {"status": "affected", "version": "9.0.0.Beta2", "lessThanOrEqual": "9.0.1.Final", "versionType": "semver"}, {"status": "affected", "version": "9.1.0.Alpha1", "lessThanOrEqual": "9.1.4.Final", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:hibernate_validator:5.4.1.final:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:6.2.5.final:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:7.0.0.alpha1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:7.0.5.final:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:8.0.0.alpha1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:8.0.5.final:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:9.0.0.beta2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:9.0.1.final:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:9.1.0.alpha1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:9.1.4.final:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7293301", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "workarounds": [{"lang": "en", "value": "The safe alternative for custom validators is to use `addExpressionVariable` instead of `addMessageParameter` when injecting user-controlled values into EL-enabled messages, as expression variables are bound as typed objects and are never re-parsed as EL expressions.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The safe alternative for custom validators is to use `addExpressionVariable` instead of `addMessageParameter` when injecting user-controlled values into EL-enabled messages, as expression variables are bound as typed objects and are never re-parsed as EL expressions.</p>"}]}], "solutions": [{"lang": "en", "value": "It is strongly recommended to address the vulnerability by upgrading to the latest version.\n\n\n\nUpgrade to 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final, 9.1.5.Final or later.\n\n\n\nFor more information see: https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>It is strongly recommended to address the vulnerability by upgrading to the latest version.</p><p>Upgrade to 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final, 9.1.5.Final or later.</p><p>For more information see: <a href=\"https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5\" rel=\"noreferrer noopener nofollow\">https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5</a></p>"}]}]}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:hibernate_validator:5.4.1.final:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:6.2.5.final:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:7.0.0.alpha1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:7.0.5.final:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:8.0.0.alpha1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:8.0.5.final:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:9.0.0.beta2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:9.0.1.final:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:9.1.0.alpha1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:hibernate_validator:9.1.4.final:*:*:*:*:*:*:*"], "product": "Hibernate Validator", "vendor": "IBM", "versions": [{"lessThanOrEqual": "6.2.5.Final", "status": "affected", "version": "5.4.1.Final", "versionType": "semver"}, {"lessThanOrEqual": "7.0.5.Final", "status": "affected", "version": "7.0.0.Alpha1", "versionType": "semver"}, {"lessThanOrEqual": "8.0.5.Final", "status": "affected", "version": "8.0.0.Alpha1", "versionType": "semver"}, {"lessThanOrEqual": "9.0.1.Final", "status": "affected", "version": "9.0.0.Beta2", "versionType": "semver"}, {"lessThanOrEqual": "9.1.4.Final", "status": "affected", "version": "9.1.0.Alpha1", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions."}], "id": "CVE-2026-93879", "lastModified": "2026-11-08T19:17:43.943", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Primary"}]}, "published": "2026-11-08T19:17:43.763", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7293301"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "psirt@us.ibm.com", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Mike Read (JP Morgan) for reporting this issue.", "bugzilla": {"description": "org.hibernate.validator:hibernate-validator: Hibernate Validator - unescaped {duplicates} message parameter is re-evaluated as Expression Language (unauthenticated DoS)", "id": "2540892", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540892"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-400", "details": ["A flaw was found in Hibernate Validator starting with version 5.4.1. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by submitting specially crafted input containing unescaped message parameters. Improper escaping allows user-supplied data to be re-evaluated during Expression Language (EL) processing, leading to excessive resource consumption and application unresponsiveness."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-93879", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Under investigation", "package_name": "exploit-intelligence/agent-client-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Under investigation", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Under investigation", "package_name": "rhbk/keycloak-rhel9-operator", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "moditect", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-osgi-karaf-features", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-annotation-processor", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-parent", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "jboss-eap-7/eap74-els-openjdk11-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "jboss-eap-7/eap74-els-openjdk17-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "jboss-eap-7/eap74-els-openjdk8-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-trustyai-service-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Under investigation", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Under investigation", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Under investigation", "package_name": "candlepin", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat Single Sign-On 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-10-12T16:18:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93879\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93879"], "statement": "Red Hat Product Security rates this vulnerability as Moderate because it enables a denial of service through resource exhaustion without compromising data integrity or confidentiality. Applications utilizing Hibernate Validator to process untrusted input may experience thread starvation or high CPU usage when validation message templates re-evaluate duplicate parameters via the expression language engine. Exploitation requires submitting tailored payloads to application endpoints performing Bean Validation, but it cannot be leveraged to achieve code execution or data leakage in typical deployments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.4.1,*]"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 81.0, "source": "matching"}]}, "product": "hibernate-validator", "vendor": "hibernate"}], "created": "2026-10-13T01:45:17.950960+00:00", "updated": "2026-10-21T15:15:14.080099+00:00", "vendors": ["hibernate", "hibernate$PRODUCT$hibernate-validator"]}