CVE-2026-0603: Hibernate Core SQL Injection Vulnerability
Summary
CVE-2026-0603: Hibernate vulnerable to SQL Injection. Affects org.hibernate:hibernate-core versions >= 5.2.8, <= 5.2.15. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hibernate is a powerful, high-performance Object-Relational Mapping (ORM) framework for Java. It simplifies database interactions by allowing developers to work with Java objects instead of SQL queries. Hibernate is widely used in enterprise applications for its ability to manage complex data relationships and provide a robust data access layer. However, it is susceptible to certain vulnerabilities, including SQL injection, which can compromise the integrity and security of applications using it.
Vulnerability Detail
A second-order SQL injection vulnerability exists in Hibernate, specifically in the InlineIdsOrClauseBuilder component. This flaw allows a remote attacker with low privileges to exploit the application by injecting specially crafted, unsanitized non-alphanumeric characters into the ID column. The consequences of this vulnerability can be severe, including unauthorized access to sensitive information, manipulation or deletion of database records, and potential application-level denial of service. The vulnerability is classified under CWE-89, indicating its nature as an SQL injection issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize inputs to the ID column by implementing validation checks that restrict non-alphanumeric characters. This can be done by adding input validation logic in your application code to ensure that only valid characters are accepted. For example: if (input.matches("^[a-zA-Z0-9]*$")) { // proceed with processing } else { // reject input }.
Conclusion
The CVE-2026-0603 vulnerability in Hibernate poses significant risks due to its potential for SQL injection attacks. It is crucial for developers using affected versions to update their dependencies promptly and implement input validation as a temporary measure. Utilizing tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for org.hibernate:hibernate-core →
FAQ
CVE-2026-0603 is a vulnerability in Hibernate that allows for SQL injection through unsanitized input in the ID column.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your pom.xml for vulnerabilities.
The risks include unauthorized access to sensitive data, potential data manipulation or deletion, and application-level denial of service.
Update your Maven dependency in the pom.xml file to version 5.2.16 or later to patch the vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for org.hibernate:hibernate-core.
