{"id":"CVE-2023-1932","aliases":["CLSA-2026-1773965923","CLSA-2026-1792693332","CLSA-2026-1793879213","CLSA-2026-1794183436","DEBIAN-CVE-2023-1932","EUVD-2024-3327","GHSA-x83m-pf6f-pf9g","UBUNTU-CVE-2023-1932"],"status":"published","title":"Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss","description":"A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00493,"percentile":0.42601,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-11-07T10:00:51Z","modified":"2026-11-09T07:15:04Z","fixes":[{"ecosystem":"Maven","package":"org.hibernate.validator:hibernate-validator","fixed_in":["6.2.0.Final"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.hibernate:hibernate-validator","fixed_in":["6.2.0.Final"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.hibernate.validator:hibernate-validator","fixed_in":["6.0.17.Final-tuxcare.3","6.0.22.Final-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.hibernate:hibernate-validator","fixed_in":["6.0.17.Final-tuxcare.3","5.0.0.Final-tuxcare.1","6.0.22.Final-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.hibernate.validator:hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.hibernate:hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0.Final"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.hibernate:hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.3.Final"},{"fixed":"5.4.3.Final-tuxcare.2"}]}],"versions":["5.4.3.Final","5.4.3.Final-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.hibernate.validator:hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.17.Final"},{"fixed":"6.0.17.Final-tuxcare.3"}]}],"versions":["6.0.17.Final","6.0.17.Final-tuxcare.1","6.0.17.Final-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.hibernate:hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.17.Final"},{"fixed":"6.0.17.Final-tuxcare.3"}]}],"versions":["6.0.17.Final","6.0.17.Final-tuxcare.1","6.0.17.Final-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.hibernate:hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0.Final"},{"fixed":"5.0.0.Final-tuxcare.1"}]}],"versions":["5.0.0.Final"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.hibernate.validator:hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.22.Final"},{"fixed":"6.0.22.Final-tuxcare.1"}]}],"versions":["6.0.22.Final"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.hibernate:hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.22.Final"},{"fixed":"6.0.22.Final-tuxcare.1"}]}],"versions":["6.0.22.Final"]},{"source":"osv","ecosystem":"Debian:12","package":"libhibernate-validator-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.6-2","5.3.6-3"]},{"source":"osv","ecosystem":"Debian:13","package":"libhibernate-validator-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.6-3"]},{"source":"osv","ecosystem":"Debian:14","package":"libhibernate-validator-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.6-3"]},{"source":"osv","ecosystem":"Maven","package":"org.hibernate.validator:hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0.Final"}]}],"versions":["6.0.0.Alpha1","6.0.0.Alpha2","6.0.0.Beta1","6.0.0.Beta2","6.0.0.CR1","6.0.0.CR2","6.0.0.CR3","6.0.0.Final","6.0.1.Final","6.0.10.Final","6.0.11.Final","6.0.12.Final","6.0.13.Final","6.0.14.Final","6.0.15.Final","6.0.16.Final","6.0.17.Final","6.0.18.Final","6.0.19.Final","6.0.2.Final","6.0.20.Final","6.0.21.Final","6.0.22.Final","6.0.23.Final","6.0.3.Final","6.0.4.Final","6.0.5.Final","6.0.6.Final","6.0.7.Final","6.0.8.Final","6.0.9.Final","6.1.0.Alpha1","6.1.0.Alpha2","6.1.0.Alpha3","6.1.0.Alpha4","6.1.0.Alpha5","6.1.0.Alpha6","6.1.0.Final","6.1.1.Final","6.1.2.Final","6.1.3.Final","6.1.4.Final","6.1.5.Final","6.1.6.Final","6.1.7.Final","6.2.0.CR1"]},{"source":"osv","ecosystem":"Maven","package":"org.hibernate:hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0.Final"}]}],"versions":["3.0.0.GA","3.0.0.ga","3.1.0.CR1","3.1.0.CR2","3.1.0.GA","4.0.0.Alpha1","4.0.0.Alpha2","4.0.0.Alpha3","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.CR1","4.0.0.GA","4.0.1.GA","4.0.2.GA","4.1.0.Beta1","4.1.0.Beta2","4.1.0.CR1","4.1.0.Final","4.2.0.Beta1","4.2.0.Beta2","4.2.0.CR1","4.2.0.Final","4.3.0.Alpha1","4.3.0.Beta1","4.3.0.CR1","4.3.0.Final","4.3.1.Final","4.3.2.Final","5.0.0.Alpha1","5.0.0.Alpha2","5.0.0.Beta1","5.0.0.CR1","5.0.0.CR2","5.0.0.CR3","5.0.0.CR4","5.0.0.CR5","5.0.0.Final","5.0.1.Final","5.0.2.Final","5.0.3.Final","5.1.0.Alpha1","5.1.0.Beta1","5.1.0.CR1","5.1.0.Final","5.1.1.Final","5.1.2.Final","5.1.3.Final","5.2.0.Alpha1","5.2.0.Beta1","5.2.0.CR1","5.2.0.Final","5.2.1.Final","5.2.2.Final","5.2.3.Final","5.2.4.Final","5.2.5.Final","5.3.0.Alpha1","5.3.0.CR1","5.3.0.Final","5.3.1.Final","5.3.2.Final","5.3.3.Final","5.3.4.Final","5.3.5.Final","5.3.6.Final","5.4.0.Beta1","5.4.0.CR1","5.4.0.Final","5.4.1.Final","5.4.2.Final","5.4.3.Final","6.0.0.Alpha1","6.0.0.Alpha2","6.0.0.Beta1","6.0.0.Beta2","6.0.0.CR1","6.0.0.CR2","6.0.0.CR3","6.0.0.Final","6.0.1.Final","6.0.10.Final","6.0.11.Final","6.0.12.Final","6.0.13.Final","6.0.14.Final","6.0.15.Final","6.0.16.Final","6.0.17.Final","6.0.18.Final","6.0.19.Final","6.0.2.Final","6.0.20.Final","6.0.21.Final","6.0.22.Final","6.0.23.Final","6.0.3.Final","6.0.4.Final","6.0.5.Final","6.0.6.Final","6.0.7.Final","6.0.8.Final","6.0.9.Final","6.1.0.Alpha1","6.1.0.Alpha2","6.1.0.Alpha3","6.1.0.Alpha4","6.1.0.Alpha5","6.1.0.Alpha6","6.1.0.Final","6.1.1.Final","6.1.2.Final","6.1.3.Final","6.1.4.Final","6.1.5.Final","6.1.6.Final","6.1.7.Final","6.2.0.CR1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libhibernate-validator-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libhibernate-validator-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.3-2","4.3.3-3","4.3.3-4","4.3.4-1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libhibernate-validator-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.4-1","5.3.6-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libhibernate-validator-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.6-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libhibernate-validator-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.6-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libhibernate-validator-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libhibernate-validator-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libhibernate-validator-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.6-3"]}],"products":[{"vendor":"hibernate","product":"hibernate-validator"},{"vendor":"red hat","product":"a-mq clients 2"},{"vendor":"red hat","product":"cryostat 2"},{"vendor":"red hat","product":"red hat a-mq online"},{"vendor":"red hat","product":"red hat amq broker 7"},{"vendor":"red hat","product":"red hat bpm suite 6"},{"vendor":"red hat","product":"red hat codeready studio 12"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat decision manager 7"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss brms 5"},{"vendor":"red hat","product":"red hat jboss data grid 7"},{"vendor":"red hat","product":"red hat jboss data virtualization 6"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 5"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 6"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform continuous delivery"},{"vendor":"red hat","product":"red hat jboss fuse 6"},{"vendor":"red hat","product":"red hat jboss fuse service works 6"},{"vendor":"red hat","product":"red hat jboss operations network 3"},{"vendor":"red hat","product":"red hat jboss soa platform 5"},{"vendor":"red hat","product":"red hat openstack platform 10 (newton)"},{"vendor":"red hat","product":"red hat openstack platform 13 (queens)"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat single sign-on 7"},{"vendor":"red hat","product":"red hat support for spring boot"},{"vendor":"red hat","product":"streams for apache kafka"},{"vendor":"redhat","product":"codeready_studio"},{"vendor":"redhat","product":"jboss_enterprise_application_platform"},{"vendor":"redhat","product":"openstack_platform"},{"vendor":"redhat","product":"single_sign-on"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-1932","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1809444","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1932","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x83m-pf6f-pf9g"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1932.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-1932","tags":["advisory"]},{"url":"https://github.com/hibernate/hibernate-validator","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-1932","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1932","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-1932","title":"Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss","description":"A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.","status":"published","published":"2024-11-07T10:00:51.745Z","modified":"2024-11-07T14:09:26.936Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:32.019713Z"}],"euvd":[{"id":"EUVD-2024-3327","description":"A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.","status":"published","published":"2024-11-07T10:00:51Z","modified":"2024-11-07T14:09:26Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:05:08.721426Z"}],"ghsa":[{"id":"GHSA-x83m-pf6f-pf9g","title":"hibernate-validator Cross-site Scripting vulnerability","description":"A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.","status":"published","published":"2024-11-07T12:30:34Z","modified":"2025-09-12T17:35:28Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:57.074217Z"}],"nvd":[{"id":"CVE-2023-1932","description":"A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.","status":"published","published":"2024-11-07T10:15:04.507Z","modified":"2026-06-17T05:29:03.803Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:19.052418Z"}],"osv":[{"id":"CVE-2023-1932","title":"Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss","description":"A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.","status":"published","published":"2024-11-07T10:00:51.745Z","modified":"2026-10-28T02:30:43.592070674Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"DEBIAN-CVE-2023-1932","description":"A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.","status":"published","published":"2024-11-07T10:15:04.507Z","modified":"2026-10-26T18:01:34.835083875Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"GHSA-x83m-pf6f-pf9g","title":"hibernate-validator Cross-site Scripting vulnerability","description":"A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.","status":"published","published":"2024-11-07T12:30:34Z","modified":"2025-09-12T19:07:09.124119Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"UBUNTU-CVE-2023-1932","description":"A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.","status":"published","published":"2024-11-07T10:15:00Z","modified":"2026-10-17T12:56:03.839483652Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:18.756095Z"},{"id":"CLSA-2026-1773965923","title":"TuxCare security update for org.hibernate:hibernate-validator (2 CVEs)","description":"TuxCare rebuilt org.hibernate:hibernate-validator to address 2 CVEs. Fixed in 5.4.3.Final-tuxcare.2.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-11-02T19:45:15.776711481Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1792693332","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 6.0.17.Final-tuxcare.3.","status":"published","published":"2026-10-22T18:22:12Z","modified":"2026-11-02T19:46:30.898152433Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793879213","title":"TuxCare security update for org.hibernate:hibernate-validator (1 CVE)","description":"TuxCare rebuilt org.hibernate:hibernate-validator to address 1 CVE. Fixed in 5.0.0.Final-tuxcare.1.","status":"published","published":"2026-11-05T12:46:54Z","modified":"2026-11-06T13:15:03.857834405Z","updated_at":"2026-11-06T13:44:21.739016Z"},{"id":"CLSA-2026-1794183436","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 6.0.22.Final-tuxcare.1.","status":"published","published":"2026-11-09T01:17:16Z","modified":"2026-11-09T07:15:04.617545442Z","updated_at":"2026-11-09T07:20:29.20536Z"}]}}