Description
A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | org.hibernate/hibernate-core | 5.2.8 – ≤ 5.6.15 | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4.24 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6.13 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | — | — |
| Red Hat | RHEL-8 based Middleware Containers | — | — |
| Red Hat | Red Hat AMQ Broker 7 | — | — |
| Red Hat | Red Hat build of OptaPlanner 8 | — | — |
| Red Hat | Red Hat Data Grid 8 | — | — |
| Red Hat | Red Hat Fuse 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
| Red Hat | Red Hat OpenShift Dev Spaces | — | — |
| Red Hat | Red Hat Process Automation 7 | — | — |
| Red Hat | Red Hat Satellite 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.20-1.redhat_00001.1.el7sso | RHSA-2026:76130, RHSA-2026:76129, RHSA-2026:76128 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.1.16-6.redhat_00006.1.ep7.el7 | RHSA-2026:6012, RHSA-2026:6011 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-eclipse-jgit | 5.13.5.202508271544-1.r_redhat_00001.1.el7eap | RHSA-2026:6011 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-hibernate +5 | 5.1.17-4.Final_redhat_00005.1.ep7.el7 | RHSA-2026:6012, RHSA-2026:6011 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jbossws-cxf | 5.1.11-1.SP1_redhat_00001.1.ep7.el7 | RHSA-2026:6012, RHSA-2026:6011 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-19.SP17_redhat_00001.1.ep7.el7 | RHSA-2026:6012, RHSA-2026:6011 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.14-4.GA_redhat_00003.1.ep7.el7 | RHSA-2026:6012, RHSA-2026:6011 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.17-5.GA_redhat_00006.1.el7eap | RHSA-2026:6011 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-apache-cxf +3 | 3.5.11-1.SP1_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-eclipse-jgit | 5.13.5.202508271544-2.r_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-hibernate +4 | 5.3.38-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jboss-marshalling +1 | 2.0.16-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-netty +26 | 4.1.124-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-undertow | 2.2.39-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly +4 | 7.4.24-4.GA_redhat_00002.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly-java-jdk17 | 7.4.24-4.GA_redhat_00002.1.el8eap | RHSA-2026:4917, RHSA-2026:4916 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 2 repositories
-
yym8538/CVE-2026-0603 ★ 1 · Aug 21, 2026
-
EQSTLab/CVE-2026-0603 ★ 1 · Apr 23, 2026
Hibernate ORM Second-Order SQL Injection
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.hibernate:hibernate-core | >= 5.2.8, < 5.3.38 | 5.3.38 | GHSA-2p5w-cvg5-gc5c |
Advisories 11
- WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- RHSA-2026:76130 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76129 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76128 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4917 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4916 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4915 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:6011 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.17 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:6012 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.14 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026
- WID-SEC-2026-1428 NetApp ActiveIQ Unified Manager: Schwachstelle ermöglicht Manipulation von Daten, Offenlegung von Informationen und Denial of Service BSI CERT-Bund (WID) · May 7, 2026
References
- RHSA-2026:4915 vendor-advisory
- RHSA-2026:4916 vendor-advisory
- RHSA-2026:4917 vendor-advisory
- RHSA-2026:4924 vendor-advisory
- RHSA-2026:6011 vendor-advisory
- RHSA-2026:6012 vendor-advisory
- RHSA-2026:76128 vendor-advisory
- RHSA-2026:76129 vendor-advisory
- RHSA-2026:76130 vendor-advisory
- RHSA-2026:76132 vendor-advisory
- RHSA-2026:76134 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-0603 vdb-entry
- RHBZ#2427147 issue-tracking