CVE-2026-93879: Hibernate Validator expression language injection in validators

CVE-2026-93879 · Severity: high · CVSS 7.5 · Published 2026-11-08

Hibernate Validator is a Java library used to validate data and enforce business rules in applications. A flaw in how it processes user-controlled data in validation messages allows an attacker to inject malicious code that consumes system resources, causing the application to become unresponsive or crash. Remote attackers can trigger this with no authentication or user interaction required.

Vendors: Red Hat.

Quick answers

Is CVE-2026-93879 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-93879 being exploited in the wild.
How severe is CVE-2026-93879?
High severity, with a CVSS score of 7.5, published 8 November 2026.
Which products and versions are affected?
Red Hat Hibernate Validator 5.4.1.Final–6.2.5.Final, 7.0.0.Alpha1–7.0.5.Final, 8.0.0.Alpha1–8.0.5.Final, 9.0.0.Beta2–9.0.1.Final, 9.1.0.Alpha1–9.1.4.Final.
Is there a fix for CVE-2026-93879?
Yes: fixed in Hibernate Validator 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final, 9.1.5.Final or later. Until then: For custom validators, use addExpressionVariable instead of addMessageParameter when injecting user-controlled values into EL-enabled messages, as expression variables are bound as typed objects and are never re-parsed as EL expressions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93879 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-93879?
Check whether you run Red Hat Hibernate Validator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Hibernate Validator 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final, 9.1.5.Final or later

For custom validators, use addExpressionVariable instead of addMessageParameter when injecting user-controlled values into EL-enabled messages, as expression variables are bound as typed objects and are never re-parsed as EL expressions.

Technical details

The vulnerability is an expression language (EL) injection flaw where user-controlled data is improperly escaped before being included in EL expressions within validator messages, resulting in uncontrolled resource consumption (CWE-400). An unauthenticated network attacker can exploit this by supplying crafted input to cause a denial of service. The advisory recommends using addExpressionVariable instead of addMessageParameter when injecting untrusted values into EL-enabled messages, as expression variables are treated as typed objects and bypass EL re-parsing.

Affected products

  • Red Hat Hibernate Validator 5.4.1.Final–6.2.5.Final, 7.0.0.Alpha1–7.0.5.Final, 8.0.0.Alpha1–8.0.5.Final, 9.0.0.Beta2–9.0.1.Final, 9.1.0.Alpha1–9.1.4.Final

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.