CVE-2019-10219: A vulnerability was found in Hibernate-Validator

This month

MEDIUM 6.1WATCHLISTUPGRADEDOWNGRADEMITIGATE

CVE-2019-10219 is a medium-severity flaw (CVSS 6.1) affecting hibernate validator, fuse, jboss data grid. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Why this priority

On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	6.1 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	2.2% (top 18%)
CISA exploited list	No
Weakness	CWE-79
Published	2019-11-08
Last modified	2026-10-08

Publisher (CNA): Red Hat, Inc. · Vendor: redhat

Last updated 2026-10-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2019-11-08 15:15 UTCPublished CVE record published
2026-10-08 22:16 UTCUpdated Record last modified

redhat hibernate validator UPGRADE

Affected: < 6.0.18 · 6.1.0 alpha1 · 6.1.0 alpha2 · 6.1.0 alpha3 · 6.1.0 alpha4 · 6.1.0 alpha5 · 6.1.0 alpha6

Fixed in: 6.0.18

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy hibernate-validator || rpm -q hibernate-validator || hibernate-validator --version

2. UPGRADE to 6.0.18 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade hibernate-validator

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade hibernate-validator

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

redhat fuse DOWNGRADE

Affected: 1.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.0

1. Check installed version

apt-cache policy fuse || rpm -q fuse || fuse --version

2. No fixed release: DOWNGRADE to a release before 1.0 (Debian / Ubuntu)

apt-cache madison fuse sudo apt install fuse=<VERSION_BEFORE_1.0> sudo apt-mark hold fuse

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list fuse sudo dnf downgrade fuse-<VERSION_BEFORE_1.0> sudo dnf versionlock add fuse

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat jboss data grid MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy jboss-data-grid || rpm -q jboss-data-grid || jboss-data-grid --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

redhat jboss enterprise application platform DOWNGRADE

Affected: all versions · 7.2 · 7.3

Fixed in: no fixed release known

Safe to downgrade to: a release before 7.2

1. Check installed version

apt-cache policy jboss-enterprise-application-platform || rpm -q jboss-enterprise-application-platform || jboss-enterprise-application-platform --version

2. No fixed release: DOWNGRADE to a release before 7.2 (Debian / Ubuntu)

apt-cache madison jboss-enterprise-application-platform sudo apt install jboss-enterprise-application-platform=<VERSION_BEFORE_7.2> sudo apt-mark hold jboss-enterprise-application-platform

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list jboss-enterprise-application-platform sudo dnf downgrade jboss-enterprise-application-platform-<VERSION_BEFORE_7.2> sudo dnf versionlock add jboss-enterprise-application-platform

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat openshift application runtimes MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy openshift-application-runtimes || rpm -q openshift-application-runtimes || openshift-application-runtimes --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

redhat single sign-on MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy single-sign-on || rpm -q single-sign-on || single-sign-on --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-10219?

hibernate validator: upgrade to 6.0.18; fuse: downgrade or apply the listed mitigation; jboss data grid: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2019-10219 being exploited?

CVE-2019-10219 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-10219 affect?

CVE-2019-10219 affects hibernate validator, fuse, jboss data grid. Severity is medium (CVSS 6.1). A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS atta

How urgent is CVE-2019-10219?

Priority 47/100. On your watchlist

Software pages

JBoss and WildFly vulnerabilities · Red Hat OpenShift vulnerabilities

Related CVEs

CVE-2025-35036 HIGH 7.3 UPGRADE Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supp
CVE-2020-10693 MEDIUM 5.3 UPGRADE UPGRADE A flaw was found in Hibernate Validator version 6.1.2.Final
CVE-2017-7536 HIGH 7.0 UPGRADE DOWNGRADE In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager

References

← Back to latest CVEs