SA-2026-019 - Hibernate Validator EL Interpolation Code Injection (CVE-2025-35036)
Summary Hibernate Validator, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to ac...