GHSA-2p5w-cvg5-gc5c
Hibernate vulnerable to SQL Injection
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-0603
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Description
A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.hibernate:hibernate-core | introduced 5.2.8, fixed 5.3.38 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2026-0603 ADVISORY
- https://github.com/hibernate/hibernate-orm/commit/3f820fdf16ee4d1f556bc73b259625416d703048 WEB
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0603.json WEB
- https://github.com/hibernate/hibernate-orm PACKAGE
- https://bugzilla.redhat.com/show_bug.cgi?id=2427147 WEB
- https://access.redhat.com/security/cve/CVE-2026-0603 WEB
- https://access.redhat.com/errata/RHSA-2026:76134 WEB
- https://access.redhat.com/errata/RHSA-2026:76132 WEB
- https://access.redhat.com/errata/RHSA-2026:76130 WEB
- https://access.redhat.com/errata/RHSA-2026:76129 WEB
- https://access.redhat.com/errata/RHSA-2026:76128 WEB
- https://access.redhat.com/errata/RHSA-2026:6012 WEB
- https://access.redhat.com/errata/RHSA-2026:6011 WEB
- https://access.redhat.com/errata/RHSA-2026:4924 WEB
- https://access.redhat.com/errata/RHSA-2026:4917 WEB
- https://access.redhat.com/errata/RHSA-2026:4916 WEB
- https://access.redhat.com/errata/RHSA-2026:4915 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |