CVE-2017-7536 Hibernate Validator
| Affected software | Hibernate Validator |
|---|---|
| Severity | 7.0 High CVSS 3.1 2 scores |
| Fixed in | 5.2.5.Final, 5.3.6.Final, 5.4.2.Final |
| Weakness | Unsafe reflection (CWE-470) |
| Published | 10 Jan 2018 |
| Updated | 17 Jun 2026 |
Description
In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().
CWE-592
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 8 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 0.48% chance in 30 days
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Reflection
- Action available security rule
- Review automated Inferred
- Record active
| Decided by | A vulnerability class already blocked by an ARMR security rule |
|---|---|
| Finding | Protected by Waratek's ARMR reflection security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-470: Unsafe Reflection. |
| Candidate fix | https://bugzilla.redhat.com/show_bug.cgi?id=1465573 : a Red Hat bug: the triage, which links onward to the fix |
How to mitigate CVE-2017-7536
Upgrade Hibernate Validator to a release that fixes it: 5.2.5.Final, 5.3.6.Final or 5.4.2.Final. Until you can, Waratek RASP blocks exploitation with its reflection rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
7.0 HIGH
v3.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
7.0 HIGH v3.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.0 | HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 2.0 | 4.4 | none | AV:L/AC:M/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.hibernate:hibernate-validator |
5.2.0 | 5.2.5.Final |
unbounded |
org.hibernate:hibernate-validator |
5.3.0 | 5.3.6.Final |
unbounded |
org.hibernate:hibernate-validator |
5.4.0 | 5.4.2.Final |
unbounded |
Products and versions
7 products, 14 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| osv | org.hibernate | hibernate-validator | generic | ≥ 5.2.0 and ＜ 5.2.5 · ≥ 5.3.0 and ＜ 5.3.6 · ≥ 5.4.0 and ＜ 5.4.2 |
| nvd | redhat | hibernate validator | generic | ≥ 5.2.0 and ＜ 5.2.5 · ≥ 5.3.0 and ＜ 5.3.6 · ≥ 5.4.0 and ＜ 5.4.2 |
| nvd | redhat | jboss enterprise application platform | generic | 6.0.0 · 6.4.0 · 7.0 · 7.1 |
| nvd | redhat | satellite | generic | 6.4 |
| nvd | redhat | satellite capsule | generic | 6.4 |
| nvd | redhat | virtualization | generic | 4.0 |
| nvd | redhat | virtualization host | generic | 4.0 |
References
Timeline
Timeline
| Published | 2018-01-10 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |