CVE-2026-0603GHSA-2p5w-cvg5-gc5c
org.hibernate:hibernate-core: Hibernate vulnerable to SQL Injection
org.hibernate:hibernate-coremavenLibraries & packages
CVSS
8.3HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.03%Chance of exploitation activity in the next 30 days, higher than 63% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 5.3.38org.hibernate:hibernate-core, mavenGitHub
<dependency><groupId>org.hibernate</groupId><artifactId>hibernate-core</artifactId><version>5.3.38</version></dependency> - 5.3.38org.hibernate:hibernate-core, MavenOSV
<dependency><groupId>org.hibernate</groupId><artifactId>hibernate-core</artifactId><version>5.3.38</version></dependency>
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.
Text from CVE List
Affected versions 68
- org.hibernate:hibernate-core, maven>= 5.2.8, < 5.3.38GitHub
- Productaffected: 5.2.8 through 5.6.15CVE List
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7unaffected: 0:5.1.17-4.Final_redhat_00005.1.ep7.el7 and laterCVE List
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7unaffected: 0:7.1.14-4.GA_redhat_00003.1.ep7.el7 and laterCVE List
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7unaffected: 0:5.3.38-1.Final_redhat_00001.1.el7eap and laterCVE List
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7unaffected: 0:7.3.17-5.GA_redhat_00006.1.el7eap and laterCVE List
- Red Hat JBoss Enterprise Application Platform 7.4.24unaffected: 5.3.38.Final-redhat-00001 and laterCVE List
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7unaffected: 0:5.3.38-1.Final_redhat_00001.1.el7eap and laterCVE List
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7unaffected: 0:7.4.24-4.GA_redhat_00002.1.el7eap and laterCVE List
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8unaffected: 0:5.3.38-1.Final_redhat_00001.1.el8eap and laterCVE List
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8unaffected: 0:7.4.24-4.GA_redhat_00002.1.el8eap and laterCVE List
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9unaffected: 0:5.3.38-1.Final_redhat_00001.1.el9eap and laterCVE List
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9unaffected: 0:7.4.24-4.GA_redhat_00002.1.el9eap and laterCVE List
- Red Hat Single Sign-On 7.6 for RHEL 7unaffected: 0:18.0.20-1.redhat_00001.1.el7sso and laterCVE List
- Red Hat Single Sign-On 7.6 for RHEL 8unaffected: 0:18.0.20-1.redhat_00001.1.el8sso and laterCVE List
- Red Hat Single Sign-On 7.6 for RHEL 9unaffected: 0:18.0.20-1.redhat_00001.1.el9sso and laterCVE List
- RHEL-8 based Middleware Containersunaffected: 7.6-85 and laterCVE List
- org.hibernate:hibernate-core, Mavenfrom 5.2.8, fixed in 5.3.38OSV
- org.hibernate:hibernate-core, Maven5.2.10.FinalOSV
- org.hibernate:hibernate-core, Maven5.2.11.FinalOSV
- org.hibernate:hibernate-core, Maven5.2.12.FinalOSV
- org.hibernate:hibernate-core, Maven5.2.13.FinalOSV
- org.hibernate:hibernate-core, Maven5.2.14.FinalOSV
- org.hibernate:hibernate-core, Maven5.2.15.FinalOSV
- org.hibernate:hibernate-core, Maven5.2.16.FinalOSV
- org.hibernate:hibernate-core, Maven5.2.17.FinalOSV
- org.hibernate:hibernate-core, Maven5.2.18.FinalOSV
- org.hibernate:hibernate-core, Maven5.2.8.FinalOSV
- org.hibernate:hibernate-core, Maven5.2.9.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.0.Beta1OSV
- org.hibernate:hibernate-core, Maven5.3.0.Beta2OSV
- org.hibernate:hibernate-core, Maven5.3.0.CR1OSV
- org.hibernate:hibernate-core, Maven5.3.0.CR2OSV
- org.hibernate:hibernate-core, Maven5.3.0.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.1.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.10.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.11.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.12.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.13.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.14.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.15.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.16.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.17.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.18.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.19.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.2.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.20.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.21.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.22.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.23.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.24.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.25.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.26.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.27.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.28.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.29.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.3.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.30.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.31.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.32.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.33.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.34.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.35.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.36.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.37.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.4.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.5.FinalOSV
- org.hibernate:hibernate-core, Maven5.3.6.FinalOSV
References 17
- github.com/hibernate/hibernate-orm/commit/3f820fdf16ee4d1f556bc73b259625416d703048Fixvia GitHub
- access.redhat.com/security/cve/CVE-2026-0603Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:4915Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:4916Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:4917Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:4924Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:6011Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:6012Advisoryvia CVE List
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0603.jsonAdvisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:76132Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:76134Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:76129Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:76130Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:76128Advisoryvia CVE List
- github.com/advisories/GHSA-2p5w-cvg5-gc5cAdvisoryvia GitHub
- nvd.nist.gov/vuln/detail/CVE-2026-0603Referencevia GitHub
- bugzilla.redhat.com/show_bug.cgi?id=2427147Referencevia CVE List