CVE-2020-9296

Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code.

• CWE-917

• https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-002.mdThird Party Advisory
• https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-002.mdThird Party Advisory

Published

Jun 16, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9289Use of a hard-coded cryptographic key to encrypt password da…7.5
• CVE-2020-9290An Unsafe Search Path vulnerability in FortiClient for Windo…7.8
• CVE-2020-9291An Insecure Temporary File vulnerability in FortiClient for …7.8
• CVE-2020-9292An unquoted service path vulnerability in the FortiSIEM Wind…9.8
• CVE-2020-9294An improper authentication vulnerability in FortiMail 5.4.10…9.8
• CVE-2020-9295FortiOS 6.2 running AV engine version 6.00142 and below, For…7.5
• CVE-2020-9297Netflix Titus, all versions prior to version v0.1.1-rc.274, …9.8
• CVE-2020-9298The Spinnaker template resolution functionality is vulnerabl…7.5
• CVE-2020-9299There were XSS vulnerabilities discovered and reported in th…5.4
• CVE-2020-9300The Access Control issues include allowing a regular user to…6.5
• CVE-2020-9301Nolan Ray from Apple Information Security identified a secur…8.8
• CVE-2020-9306Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has…8.8