Skip to content
fr Sign in
8.3 High

CVE-2026-0603 Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

Description

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Exploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Privileges required
Low
Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Affected products and versions

Product Affected versions Fixed in
Red Hat AMQ Broker 7 Versions not published
Red Hat build of OptaPlanner 8 Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Show the 21 other branches
Product Affected versions Fixed in
Red Hat Process Automation 7 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Single Sign-On 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 Versions not published
Red Hat JBoss Enterprise Application Platform 5.3 earliest → < 5.3.38.Final-redhat-00001 5.3.38.Final-redhat-00001
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server Versions not published
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server Versions not published
Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server Versions not published
Red Hat JBoss EAP 7.4 ELS for RHEL 8 Versions not published
Red Hat JBoss EAP 7.4 ELS for RHEL 9 Versions not published
Red Hat JBoss Enterprise Application Platform 7.4.24 5.3 earliest → < 5.3.38.Final-redhat-00001 5.3.38.Final-redhat-00001
Red Hat Single Sign-On 7.6.13 Versions not published
RHEL-8 based Middleware Containers 7.6 earliest → < 7.6-85 7.6-85
Red Hat Single Sign-On 7.6 for RHEL 8 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 9 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 7 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat AMQ Broker 7

The 88 CVEs of Red Hat AMQ Broker 7 →
CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 High CVE-2026-93998 Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer 7.4 High CVE-2026-101292 Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in… 8.2 High CVE-2026-93562 A flaw was found in Netty's HTTP/1 decoder 6.5 Medium
Track this CVE