What is the CVSS score of CVE-2026-0603?

CVE-2026-0603 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Hibernate. are affected by CVE-2026-0603?

A high-severity SQL injection vulnerability in Hibernate (CVE-2026-0603) could allow attackers with low privileges to bypass security controls and access unauthorized data.. A patch is available.

How to fix or mitigate CVE-2026-0603?

Within 24 hours: Identify all systems running Hibernate and document which versions are affected; disable or restrict access to features using InlineIdsOrClauseBuilder if possible. Within 7 days: Implement input validation and WAF rules to block non-alphanumeric characters in ID parameters; conduct preliminary impact assessment of exposed systems. Within 30 days: Monitor vendor channels for patch availability and establish upgrade timeline; complete security testing of patched versions before production deployment.

Hibernate. CVE-2026-0603

HIGH

SQL Injection (CWE-89)

2026-01-23 secalert@redhat.com

GHSA-2p5w-cvg5-gc5c

SQLi Denial Of Service Information Disclosure

8.3

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Apr 09, 2026 - 14:30 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 07:15 nvd

HIGH 8.3

DescriptionCVE.org

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.

AnalysisAI

Hibernate's InlineIdsOrClauseBuilder is vulnerable to second-order SQL injection when processing non-alphanumeric characters in ID columns, allowing authenticated attackers to read sensitive data, modify database contents, or cause denial of service. The vulnerability requires low privileges and network access with no user interaction, making it exploitable by remote attackers with valid credentials. No patch is currently available.

Technical ContextAI

Classified as CWE-89 (SQL Injection). A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.

Affected ProductsAI

Component: an application level denial of.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.