CVE-2026-0603

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0603.json",
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-89"
    ]
}

References

Affected packages

Git / github.com/hibernate/hibernate-orm

Affected ranges

Type

GIT

Repo

https://github.com/hibernate/hibernate-orm

Events

Introduced

5d5b4e9776fddb96c2a0ccb1e194a33b5c73b6cd

Last affected

e924c27e1259b0b5915819e9521d86fcb8164a46

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "5.2.8"
        },
        {
            "last_affected": "5.6.15"
        }
    ]
}

Affected versions

5.*

5.2.10

5.2.11

5.2.12

5.2.8

5.2.9

5.3.0.Beta1

5.3.0.Beta2

5.3.0.CR2

5.3.0.Final

5.3.1

5.3.2

5.4.0

5.4.0.CR1

5.4.0.CR2

5.4.1

5.4.10

5.4.11

5.4.12

5.4.13

5.4.14

5.4.2

5.4.3

5.4.4

5.4.5

5.4.6

5.4.7

5.4.8

5.4.9

5.5.0

5.5.0.Alpha1

5.5.0.Beta1

5.5.0.CR1

5.5.2

5.5.3

5.5.4

5.5.5

5.5.6

5.5.7

5.6.0

5.6.0.Beta1

5.6.0.Beta2

5.6.0.CR1

5.6.1

5.6.10

5.6.11

5.6.12

5.6.13

5.6.14

5.6.15

5.6.2

5.6.3

5.6.4

5.6.5

5.6.6

5.6.7

5.6.8

5.6.9

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-0603.json"