Critical severity9.8NVD Advisory· Published Dec 9, 2021· Updated Jun 17, 2026
CVE-2021-43608
CVE-2021-43608
Description
Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
doctrine/dbalPackagist | >= 3.0.0, < 3.1.4 | 3.1.4 |
Affected products
2- Doctrine/DBALdescription
Patches
Vulnerability mechanics
References
7- github.com/doctrine/dbal/commit/9dcfa4cb6c03250b78a84737ba7ceb82f4b7ba4dnvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-r7cj-8hjg-x622ghsaADVISORY
- github.com/doctrine/dbal/releasesnvdRelease NotesThird Party AdvisoryWEB
- github.com/doctrine/dbal/security/advisories/GHSA-r7cj-8hjg-x622nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-43608ghsaADVISORY
- www.doctrine-project.org/2021/11/11/dbal3-vulnerability-fixed.htmlnvdVendor AdvisoryWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/dbal/CVE-2021-43608.yamlghsaWEB
News mentions
0No linked articles in our index yet.