Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions.
The safe alternative for custom validators is to use addExpressionVariable instead of addMessageParameter when injecting user-controlled values into EL-enabled messages, as expression variables are bound as typed objects and are never re-parsed as EL expressions.
It is strongly recommended to address the vulnerability by upgrading to the latest version.
Upgrade to 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final, 9.1.5.Final or later.
For more information see: https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5