SB2026083166 - SQL injection in Hibernate ORM

Description

This security bulletin contains information about 1 vulnerability.

1) SQL injection (CVE-ID: CVE-2026-0603)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information and manipulate or delete data.

The vulnerability exists due to sql injection in InlineIdsOrClauseBuilder when processing ID values containing unsanitized non-alphanumeric characters. A remote user can supply crafted input to disclose sensitive information and manipulate or delete data.

This is only exploitable if the user is able to set their own IDs, those IDs allow non-alphanumeric characters, and the application is using InlineIdsOrClauseBuilder.

Remediation

Install update from vendor's website.

References

• https://security.snyk.io/vuln/SNYK-JAVA-ORGHIBERNATE-15038759
• https://github.com/hibernate/hibernate-orm/commit/3f820fdf16ee4d1f556bc73b259625416d703048