A flaw in Hibernate Validator, first appearing in version 5.4.1, lets an unauthenticated attacker trigger a Denial of Service by submitting input that contains an unescaped message parameter containing braces. The unescaped parameter is re‑evaluated as an Expression Language expression, causing excessive resource consumption and rendering the application unresponsive. The weakness is classified as CWE‑400, describing improper resource consumption.

The vulnerability affects any application that integrates the Hibernate Validator library starting with version 5.4.1 and later until the fix is applied. The affected product is Oracle’s Hibernate Validator, used widely in Java applications that perform bean validation.

The CVSS score of 7.5 indicates a high severity. Because the exploit requires no authentication or special privileges and can be performed over the network by sending crafted input, the risk of exploitation is significant. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog. Attackers can achieve denial of service simply by sending a single request containing an unescaped {duplicates} placeholder. The flaw allows the Expression Language engine to re‑evaluate the parameter, leading to uncontrolled resource usage and eventual application crash or hang.