Log in Start free

Vulnerability · Published Jan 23, 2026 · Assigned by redhat

CVE-2026-0603Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

High 8.3

In plain English

A high-severity SQL injection in org.hibernate/hibernate-core. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.3High
Exploit odds (30 days)1.0%top 36.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.hibernate:hibernate-core5.3.38GHSA-2p5w-cvg5-gc5c

Affected products (as reported)

VendorProductVersions
org.hibernate/hibernate-core 5.2.8 – through 5.6.15
Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7.4.24 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 see references
Red Hat Red Hat Single Sign-On 7.6.13 see references
Red Hat Red Hat Single Sign-On 7.6 for RHEL 7 see references
Red Hat Red Hat Single Sign-On 7.6 for RHEL 8 see references
Red Hat Red Hat Single Sign-On 7.6 for RHEL 9 see references
Red Hat RHEL-8 based Middleware Containers see references
Red Hat Red Hat AMQ Broker 7 see references
Red Hat Red Hat build of OptaPlanner 8 see references
Red Hat Red Hat Data Grid 8 see references
Red Hat Red Hat Fuse 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift AI (RHOAI) see references
Red Hat Red Hat OpenShift Dev Spaces see references
Red Hat Red Hat OpenShift Dev Spaces see references
Red Hat Red Hat Process Automation 7 see references
Red Hat Red Hat Satellite 6 see references

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References