[dxbjavid]

UnicodeUnescaper.translate, which backs StringEscapeUtils.unescapeJava, unescapeEcmaScript and unescapeJson, takes the four characters after \u (or \u+) and hands them to Integer.parseInt(s, 16) without checking that they are hex digits. parseInt accepts a leading sign, so unescapeJava("\\u-03C") returns U+FFC4 (the negative value cast to char) and unescapeJava("\\u++03C") returns <. Neither is a valid Java, JSON or ECMAScript escape, and the second means a text filter looking for the canonical \u003C form can be sidestepped by an input that this method still decodes to <.

The fix rejects any non-hex character in the four-digit field with the same IllegalArgumentException the class already throws for other malformed values (for example \u00G1). Valid input, including the \u+0047 and \uuuu0047 forms, decodes exactly as before. UnicodeUnescaperTest#testSignNotHexDigit fails without the main change and passes with it, and the default mvn build is green (1990 tests).

---

• Read the contribution guidelines for this project.
• Read the ASF Generative Tooling Guidance if you use Artificial Intelligence (AI).
• I used AI to create any part of, or all of, this pull request. Which AI tool was used to create this pull request, and to what extent did it contribute?
  This fix was found and prepared with AI assistance (Claude) and reviewed by me before submitting. The AI located the defect, wrote the patch and test, and ran the build.
• Run a successful build using the default Maven goal with mvn; that's mvn on the command line by itself.
• Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible, but it is a best practice.
• Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• Each commit in the pull request should have a meaningful subject line and body. Note that a maintainer may squash commits during the merge process.