{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Mike Read (JP Morgan) for reporting this issue.", "bugzilla": {"description": "org.hibernate.validator:hibernate-validator: Hibernate Validator - unescaped {duplicates} message parameter is re-evaluated as Expression Language (unauthenticated DoS)", "id": "2540892", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540892"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-400", "details": ["A flaw was found in Hibernate Validator starting with version 5.4.1. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by submitting specially crafted input containing unescaped message parameters. Improper escaping allows user-supplied data to be re-evaluated during Expression Language (EL) processing, leading to excessive resource consumption and application unresponsiveness."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-93879", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Under investigation", "package_name": "exploit-intelligence/agent-client-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Under investigation", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Under investigation", "package_name": "rhbk/keycloak-rhel9-operator", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "moditect", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-osgi-karaf-features", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-annotation-processor", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-parent", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "jboss-eap-7/eap74-els-openjdk11-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "jboss-eap-7/eap74-els-openjdk17-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Under investigation", "package_name": "jboss-eap-7/eap74-els-openjdk8-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-trustyai-service-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Under investigation", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Under investigation", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Under investigation", "package_name": "candlepin", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Under investigation", "package_name": "hibernate-validator", "product_name": "Red Hat Single Sign-On 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Under investigation", "package_name": "hibernate-validator-cdi", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-10-12T16:18:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93879\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93879"], "statement": "Red Hat Product Security rates this vulnerability as Moderate because it enables a denial of service through resource exhaustion without compromising data integrity or confidentiality. Applications utilizing Hibernate Validator to process untrusted input may experience thread starvation or high CPU usage when validation message templates re-evaluate duplicate parameters via the expression language engine. Exploitation requires submitting tailored payloads to application endpoints performing Bean Validation, but it cannot be leveraged to achieve code execution or data leakage in typical deployments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.4.1,*]"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 81.0, "source": "matching"}]}, "product": "hibernate-validator", "vendor": "hibernate"}], "created": "2026-10-13T01:45:17.950960+00:00", "updated": "2026-10-21T15:15:14.080099+00:00", "vendors": ["hibernate", "hibernate$PRODUCT$hibernate-validator"]}