CVE-2025-5878

Publication date 29 June 2025

Last updated 16 April 2026

Ubuntu priority

Cvss 3 Severity Score

Description

A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libowasp-esapi-java	25.10 questing	Vulnerable
	25.04 plucky	Ignored end of life, was needs-triage
	24.04 LTS noble	Fixed 2.4.0.0-2ubuntu0.1
	22.04 LTS jammy	Fixed 2.2.3.1-1ubuntu0.1~esm1
	20.04 LTS focal	Fixed 2.1.0-3ubuntu0.20.04.1~esm1
	18.04 LTS bionic	Fixed 2.1.0-3ubuntu0.18.04.1~esm1
	16.04 LTS xenial	Fixed 2.1.0-2ubuntu0.1~esm1

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Notes

mrmajumder

Stand-alone users should review any use of encodeForSQL, DB2Codec, MySQLCodec, or OracleCodec, as these are deprecated and the update does not fully mitigate all application- level risk.

Severity score breakdown

Parameter	Value
Base score	7.3 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	Low
Availability impact	Low
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

Related Ubuntu Security Notices (USN)

USN-8181-1
ESAPI vulnerabilities
16 April 2026