CVE-2025-35036: 
Java vulnerability analysis and mitigation

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This vulnerability (CVE-2025-35036) was discovered in June 2025 and affects the constraint validation functionality of Hibernate Validator. The vulnerability allows an attacker to access sensitive information or execute arbitrary Java code through Expression Language evaluation of user-supplied input (NVD, Wiz).

The vulnerability exists in the Expression Language (EL) interpolation functionality of Hibernate Validator. By default, the validator may evaluate user-supplied input in constraint violation messages using Expression Language. The vulnerability has a CVSS v3.1 Base Score of 7.3 (HIGH) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L and a CVSS v4.0 score of 6.9 (MEDIUM). The issue is classified as CWE-94: Improper Control of Generation of Code ('Code Injection') (NVD, Wiz).

Successful exploitation of this vulnerability could allow attackers to execute arbitrary Java code or access sensitive information through Expression Language evaluation of user-supplied input in constraint violation messages. The vulnerability affects both the security and integrity of applications using Hibernate Validator (NVD).

Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language by default and strongly recommends not allowing user-supplied input in constraint violation messages. Users should upgrade to these versions or later. If using older versions, it is strongly recommended to not allow user-supplied input in constraint violation messages (NVD, Hibernate Blog).

The vulnerability has generated significant attention in the security community due to its potential impact on enterprise applications. Hibernate has taken a proactive approach by implementing stricter default security controls in newer versions and providing detailed guidance on secure usage patterns (Hibernate Blog).