--- id: CVE-2026-0603 title: A flaw was found in Hibernate summary: >- A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrCl… severity: high cvss: 8.3 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L' cwe: - CWE-89 vendor: Red Hat product: org.hibernate/hibernate-core affected: - org.hibernate/hibernate-core >= 5.2.8 <= 5.6.15 - eap7-hibernate (all versions) - eap7-wildfly (all versions) - eap7-hibernate (all versions) - eap7-wildfly (all versions) - org.hibernate/hibernate-core (all versions) - eap7-hibernate (all versions) - eap7-wildfly (all versions) - eap7-hibernate (all versions) - eap7-wildfly (all versions) - eap7-hibernate (all versions) - eap7-wildfly (all versions) - hibernate-core - rh-sso7-keycloak (all versions) - rh-sso7-keycloak (all versions) - rh-sso7-keycloak (all versions) - rh-sso-7/sso76-openshift-rhel8 (all versions) - hibernate-core (all versions) - hibernate-core (all versions) - hibernate-core - hibernate-core (all versions) - hibernate-core (all versions) - hibernate-core - hibernate-core - rhoai/odh-trustyai-service-rhel8 - rhoai/odh-trustyai-service-rhel9 - devspaces/openvsx-rhel9 - devspaces/pluginregistry-rhel9 - hibernate-core (all versions) - candlepin - 'satellite:el8/candlepin' patched: - 'org.hibernate:hibernate-core 5.3.38' published: '2026-01-23' updated: '2026-10-06' sourceUpdated: '2026-10-06T17:17:11.647' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0603' references: - url: 'https://access.redhat.com/errata/RHSA-2026:4915' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:4916' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:4917' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:4924' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:6011' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:6012' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:76128' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:76129' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:76130' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:76132' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:76134' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2026-0603' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2427147' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:4915' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:4916' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:4917' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:4924' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:6011' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:6012' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-0603' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2427147' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0603.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0603' - url: >- https://github.com/hibernate/hibernate-orm/commit/3f820fdf16ee4d1f556bc73b259625416d703048 - url: 'https://github.com/advisories/GHSA-2p5w-cvg5-gc5c' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-0603' tags: - nvd - cve.org - exploit-available - ghsa - maven - csaf - vex - red-hat ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-01-24T04:55:25.177681Z' epss: 0.01032 epssPercentile: 0.63587 exploits: github: 2 githubRepos: - 'https://github.com/EQSTLab/CVE-2026-0603' - 'https://github.com/yym8538/CVE-2026-0603' checkedAt: '2026-10-27T16:52:00.205Z' exploitAvailable: true aliases: - GHSA-2p5w-cvg5-gc5c ecosystem: maven ingestedAt: '2026-06-30T17:40:12.450Z' --- ## Overview A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2026-0603) Affected packages: - `org.hibernate:hibernate-core >= 5.2.8, < 5.3.38` Patched in: - `org.hibernate:hibernate-core 5.3.38` Source: https://github.com/advisories/GHSA-2p5w-cvg5-gc5c ## Vendor advisories - **RHSA-2026:6012** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6012) - **RHSA-2026:6011** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6011) - **RHSA-2026:4915** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4915) - **RHSA-2026:4916** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 8 · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4916) - **RHSA-2026:4917** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 9 · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4917) - **RHSA-2026:4924** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.4.24 · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4924) - **Red Hat VEX** · Important · affected: Red Hat AMQ Broker 7, Red Hat build of OptaPlanner 8, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat Process Automation 7 · no fix planned: Red Hat build of OptaPlanner 8, Red Hat Fuse 7, Red Hat Process Automation 7, Red Hat AMQ Broker 7, … · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0603.json) - **RHSA-2026:76134** · Red Hat · fixed in: Middleware Containers for OpenShift · released 2026-10-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:76134) - **RHSA-2026:76132** · Red Hat · fixed in: Red Hat Single Sign-On 7.6.13 · released 2026-10-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:76132)