{"affected":[{"product":"Hibernate Validator","source":"CNA: ibm","vendor":"IBM","versions":[{"lessThanOrEqual":"6.2.5.Final","status":"affected","version":"5.4.1.Final","versionType":"semver"},{"lessThanOrEqual":"7.0.5.Final","status":"affected","version":"7.0.0.Alpha1","versionType":"semver"},{"lessThanOrEqual":"8.0.5.Final","status":"affected","version":"8.0.0.Alpha1","versionType":"semver"},{"lessThanOrEqual":"9.0.1.Final","status":"affected","version":"9.0.0.Beta2","versionType":"semver"},{"lessThanOrEqual":"9.1.4.Final","status":"affected","version":"9.1.0.Alpha1","versionType":"semver"}]}],"cveId":"CVE-2026-93879","cwes":["CWE-400"],"description":"Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794163666353,"publishedAt":1794163666353,"references":[{"source":"CNA: ibm","tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7293301"}],"remediation":[{"kind":"fix","source":"CNA: ibm","text":"It is strongly recommended to address the vulnerability by upgrading to the latest version.\n\n\n\nUpgrade to 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final, 9.1.5.Final or later.\n\n\n\nFor more information see:  https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5"},{"kind":"workaround","source":"CNA: ibm","text":"The safe alternative for custom validators is to use `addExpressionVariable` instead of `addMessageParameter` when injecting user-controlled values into EL-enabled messages, as expression variables are bound as typed objects and are never re-parsed as EL expressions."},{"kind":"fix","source":"CNA: ibm","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.ibm.com/support/pages/node/7293301"}],"revision":"94e32913c9d71550140a0356223beb90b2fe4e9f223d045373a683302e814f50","sources":[{"modifiedAt":1794163666353,"name":"CNA: ibm","retrievedAt":1794164959259,"url":"https://www.cve.org/CVERecord?id=CVE-2026-93879"}],"ssvc":null,"status":"published","title":"Hibernate Validator is affected by an expression language injection vulnerability","updatedAt":1794164959259}