Improper Validation of Specified Type of Input Affecting jakarta.validation:jakarta.validation-api package, versions [2.0.1,4.0.0-M1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-JAKARTAVALIDATION-20936881
- published14 Oct 2026
- disclosed27 Sept 2026
- creditUnknown
Introduced: 27 Sep 2026
New CVE NOT AVAILABLE CWE-1287 (opens in a new tab)How to fix?
Upgrade jakarta.validation:jakarta.validation-api to version 4.0.0-M1 or higher.
Overview
Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the run method of the ProviderSpecificBootstrapImpl class in Validation.java, which passes a caller influenced action to the single argument form of AccessController.doPrivileged, dropping the calling thread's restricted ProtectionDomain from the access control stack. Code running in a restricted domain can execute an arbitrary class's no-arg constructor under the library's broader permissions by passing any Class object to Validation.byProvider through a raw or unchecked cast, since the generic bound is erased and NewProviderInstance.run reaches clazz.newInstance before the cast to ValidationProvider is attempted. Exploitation requires a JVM running with a SecurityManager, a code source for the library granted more permissions than the caller, the ability to run code in process, and a reachable class in a privileged domain whose public no-arg constructor performs a security checked side effect, and the gadget's own ProtectionDomain stays on the stack so a self defined class yields nothing.
Note: Only deployments on JDK releases before 24 are affected. The run helper elevates privilege only when System.getSecurityManager() returns non-null, and JEP 486 permanently disabled the Security Manager in JDK 24.