{"id":"CVE-2026-93879","aliases":[],"cve":{"records":[{"id":"CVE-2026-93879","source":"ibm","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-18T20:04:20.857Z","published":"2026-11-08T18:47:46.353Z","modified":"2026-11-09T14:10:37.110Z"}],"publishers":[{"name":"ibm","role":"CNA","organizationId":"9a959283-ebb5-44b6-b705-dcc2bbced522","modified":"2026-11-08T18:47:46.353Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T14:10:37.110Z"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7293301","tags":["vendor-advisory","patch"],"source":"ibm"}],"weaknesses":[{"id":"CWE-400","description":"CWE-400 Uncontrolled Resource Consumption","source":"ibm"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T14:10:28.896151Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Hibernate Validator is affected by an expression language injection vulnerability","titleSource":"ibm","descriptionSource":"ibm","description":"Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions.","score":7.5,"severity":"high","published":"2026-11-08T18:47:46.353Z","modified":"2026-11-09T14:10:37.110Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"IBM","name":"Hibernate Validator","platforms":[],"versions":[{"version":"5.4.1.Final","status":"affected","lessThanOrEqual":"6.2.5.Final","versionType":"semver"},{"version":"7.0.0.Alpha1","status":"affected","lessThanOrEqual":"7.0.5.Final","versionType":"semver"},{"version":"8.0.0.Alpha1","status":"affected","lessThanOrEqual":"8.0.5.Final","versionType":"semver"},{"version":"9.0.0.Beta2","status":"affected","lessThanOrEqual":"9.0.1.Final","versionType":"semver"},{"version":"9.1.0.Alpha1","status":"affected","lessThanOrEqual":"9.1.4.Final","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:hibernate_validator:5.4.1.final:*:*:*:*:*:*:*","cpe:2.3:a:ibm:hibernate_validator:6.2.5.final:*:*:*:*:*:*:*","cpe:2.3:a:ibm:hibernate_validator:7.0.0.alpha1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:hibernate_validator:7.0.5.final:*:*:*:*:*:*:*","cpe:2.3:a:ibm:hibernate_validator:8.0.0.alpha1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:hibernate_validator:8.0.5.final:*:*:*:*:*:*:*","cpe:2.3:a:ibm:hibernate_validator:9.0.0.beta2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:hibernate_validator:9.0.1.final:*:*:*:*:*:*:*","cpe:2.3:a:ibm:hibernate_validator:9.1.0.alpha1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:hibernate_validator:9.1.4.final:*:*:*:*:*:*:*"],"source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-93879"}],"remediation":[{"text":"It is strongly recommended to address the vulnerability by upgrading to the latest version.\n\n\n\nUpgrade to 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final, 9.1.5.Final or later.\n\n\n\nFor more information see:  https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5","source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-93879"},{"text":"The safe alternative for custom validators is to use `addExpressionVariable` instead of `addMessageParameter` when injecting user-controlled values into EL-enabled messages, as expression variables are bound as typed objects and are never re-parsed as EL expressions.","source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-93879"}],"references":["https://www.ibm.com/support/pages/node/7293301"],"sources":[{"name":"CVE","id":"CVE-2026-93879","modified":"2026-11-09T14:10:37.110Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93879"}],"assessments":[{"source":"ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-09T14:21:44.923Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T22:15:32.964Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T19:20:36.752Z","attemptedAt":"2026-11-08T19:20:36.752Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-08T19:20:37.398Z","attemptedAt":"2026-11-08T19:20:37.398Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-08T19:20:37.990Z","attemptedAt":"2026-11-08T19:20:37.990Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T19:20:37.174Z","attemptedAt":"2026-11-08T19:20:37.174Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-93879","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93879","modified":"2026-11-08T19:17:43.943","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-08T19:20:36.752Z"}],"aiSummary":{"text":"Hibernate Validator versions 5.4.1.Final to 9.1.4.Final are affected by an expression language injection vulnerability, which could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. The vulnerability is caused by improper escaping of user-controlled data in Expression Language (EL) expressions. Affected versions include 5.4.1.Final to 6.2.5.Final, 7.0.0.Alpha1 to 7.0.5.Final, 8.0.0.Alpha1 to 8.0.5.Final, 9.0.0.Beta2 to 9.0.1.Final, and 9.1.0.Alpha1 to 9.1.4.Final.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T19:21:10.731Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-93879"}]}}