Validator up to 13.15.21 isLength incomplete filtering of one or more instances of special elements

Summaryinfo

A vulnerability has been found in Validator up to 13.15.21 and classified as problematic. This affects the function isLength. Performing a manipulation results in incomplete filtering of one or more instances of special elements. This vulnerability was named CVE-2025-12758. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in Validator up to 13.15.21. This affects the function isLength. The manipulation with an unknown input leads to a incomplete filtering of one or more instances of special elements vulnerability. CWE is classifying the issue as CWE-792. The product receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component. This is going to have an impact on availability. The summary by CVE is:

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.

The advisory is shared at security.snyk.io. This vulnerability is uniquely identified as CVE-2025-12758 since 11/05/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 13.15.22 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-199795) and CERT Bund (WID-SEC-2025-2903). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• IBM App Connect Enterprise

Productinfo

Name

• Validator

Version

• 13.15.0
• 13.15.1
• 13.15.2
• 13.15.3
• 13.15.4
• 13.15.5
• 13.15.6
• 13.15.7
• 13.15.8
• 13.15.9
• 13.15.10
• 13.15.11
• 13.15.12
• 13.15.13
• 13.15.14
• 13.15.15
• 13.15.16
• 13.15.17
• 13.15.18
• 13.15.19
• 13.15.20
• 13.15.21

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion