CVE-2026-0603

Vulnerability

Description

A second-order SQL injection flaw exists in Hibernate's InlineIdsOrClauseBuilder. The root cause is the insufficient sanitization of non-alphanumeric characters supplied in the ID column. When specially crafted input is processed, the builder does not properly escape or validate these characters, allowing them to be interpreted as SQL operators or identifiers in subsequent queries [1][2].

Exploitation

Details

An attacker with low privileges can exploit this flaw remotely. The vulnerability is classified as second-order because the malicious input is stored or passed through intermediate processing before reaching a vulnerable query path. No special network position is required beyond authenticated access to an application that uses the affected Hibernate component. The attacker must be able to control the value of a column used as an ID in queries that employ InlineIdsOrClauseBuilder [1][2].

Impact

Successful exploitation can result in the reading of sensitive system files, indicating potential access to arbitrary file contents through database functions like LOAD_FILE. Additionally, the attacker may be able to manipulate or delete data within the application's database. This data integrity impact, combined with the potential for extensive resource consumption from injected queries, leads to an application-level denial of service [1][2].

Mitigation

Red Hat has released errata advisories that include updated Hibernate packages (e.g., eap7-hibernate-5.3.38-1.Final_redhat_00001.1) for Red Hat Enterprise Linux 7, 8, and 9, as well as Red Hat JBoss Enterprise Application Platform [2][3][4]. Organizations should apply these updates promptly to remediate the vulnerability. No workarounds are documented in the provided references.