Find, fix and prevent vulnerabilities in your code.

Overview

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the run method of the ProviderSpecificBootstrapImpl class in Validation.java, which passes a caller influenced action to the single argument form of AccessController.doPrivileged, dropping the calling thread's restricted ProtectionDomain from the access control stack. Code running in a restricted domain can execute an arbitrary class's no-arg constructor under the library's broader permissions by passing any Class object to Validation.byProvider through a raw or unchecked cast, since the generic bound is erased and NewProviderInstance.run reaches clazz.newInstance before the cast to ValidationProvider is attempted. Exploitation requires a JVM running with a SecurityManager, a code source for the library granted more permissions than the caller, the ability to run code in process, and a reachable class in a privileged domain whose public no-arg constructor performs a security checked side effect, and the gadget's own ProtectionDomain stays on the stack so a self defined class yields nothing.

Note: Only deployments on JDK releases before 24 are affected. The run helper elevates privilege only when System.getSecurityManager() returns non-null, and JEP 486 permanently disabled the Security Manager in JDK 24.

Remediation

Upgrade jakarta.validation:jakarta.validation-api to version 4.0.0-M1 or higher.

References

• GitHub Commit
• Vulnerability Advisory