Red Hat Hibernate Validator vulnerabilities

5 CVEs affecting Red Hat Hibernate Validator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-35036, published 2025-06-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-3558, published 2014-09-30. Medium severity, CVSS 5.0. EPSS: 2.9% chance of exploitation in the next 30 days. ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager…
CVE-2020-10693, published 2020-05-06. Medium severity, CVSS 5.3. EPSS: 2.4% chance of exploitation in the next 30 days. A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows…
CVE-2019-10219, published 2019-11-08. Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions.…
CVE-2025-35036, published 2025-06-03. High severity, CVSS 7.3. EPSS: 0.7% chance of exploitation in the next 30 days. Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow…
CVE-2017-7536, published 2018-01-10. High severity, CVSS 7.0. EPSS: 0.5% chance of exploitation in the next 30 days. In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class,…