CVE-2026-93879 - Vulnerability Details - OpenCVE

A flaw was found in Hibernate Validator starting with version 5.4.1. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by submitting specially crafted input containing unescaped message parameters. Improper escaping allows user-supplied data to be re-evaluated during Expression Language (EL) processing, leading to excessive resource consumption and application unresponsiveness.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Hibernate	Hibernate-validator

No data.

No data.

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-93879
https://www.cve.org/CVERecord?id=CVE-2026-93879

History

Wed, 21 Oct 2026 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Hibernate Hibernate hibernate-validator
Vendors & Products		Hibernate Hibernate hibernate-validator

Tue, 13 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Description		A flaw was found in Hibernate Validator starting with version 5.4.1. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by submitting specially crafted input containing unescaped message parameters. Improper escaping allows user-supplied data to be re-evaluated during Expression Language (EL) processing, leading to excessive resource consumption and application unresponsiveness.
Title		org.hibernate.validator:hibernate-validator: Hibernate Validator - unescaped {duplicates} message parameter is re-evaluated as Expression Language (unauthenticated DoS)
Weaknesses		CWE-400
References		https://nvd.nist.gov/vuln/detail/CVE-2026-93879 https://www.cve.org/CVERecord?id=CVE-2026-93879
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

MITRE

No data.

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-10-12T16:18:43Z

Links: CVE-2026-93879 - Bugzilla

{"acknowledgement": "Red Hat would like to thank Mike Read (JP Morgan) for reporting this issue.", "bugzilla": {"description": "org.hibernate.validator:hibernate-validator: Hibernate Validator - unescaped {duplicates} message parameter is re-evaluated as Expression Language (unauthenticated DoS)", "id": "2540892", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540892"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-400", "details": ["A flaw was found in Hibernate Validator starting with version 5.4.1. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by submitting specially crafted input containing unescaped message parameters. Improper escaping allows user-supplied data to be re-evaluated during Expression Language (EL) processing, leading to excessive resource consumption and application unresponsiveness."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-93879", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Under investigation", "package_name": "exploit-intelligence/agent-client-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Under investigation", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Under investigation", "package_name": "rhbk/keycloak-rhel9-operator", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "moditect", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-osgi-karaf-features", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-annotation-processor", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-parent", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "jboss-eap-7/eap74-els-openjdk11-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "jboss-eap-7/eap74-els-openjdk17-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "jboss-eap-7/eap74-els-openjdk8-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-trustyai-service-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Under investigation", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Under investigation", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Under investigation", "package_name": "candlepin", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat Single Sign-On 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-10-12T16:18:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93879\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93879"], "statement": "Red Hat Product Security rates this vulnerability as Moderate because it enables a denial of service through resource exhaustion without compromising data integrity or confidentiality. Applications utilizing Hibernate Validator to process untrusted input may experience thread starvation or high CPU usage when validation message templates re-evaluate duplicate parameters via the expression language engine. Exploitation requires submitting tailored payloads to application endpoints performing Bean Validation, but it cannot be leveraged to achieve code execution or data leakage in typical deployments.", "threat_severity": "Moderate"}