--- id: CVE-2026-0603 title: A flaw was found in Hibernate summary: >- A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrCl… severity: high cvss: 8.3 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L' cwe: - CWE-89 published: '2026-01-23' updated: '2026-06-30' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0603' references: - url: 'https://access.redhat.com/errata/RHSA-2026:4915' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:4916' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:4917' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:4924' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:6011' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:6012' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2026-0603' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2427147' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:4915' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:4916' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:4917' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:4924' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:6011' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:6012' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-0603' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2427147' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0603.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-0603' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0603' tags: - nvd - exploit-available - csaf - vex - red-hat - cve.org epss: 0.0087 epssPercentile: 0.57086 ingestedAt: '2026-06-30T17:40:12.450Z' exploits: github: 2 githubRepos: - 'https://github.com/EQSTLab/CVE-2026-0603' - 'https://github.com/yym8538/CVE-2026-0603' checkedAt: '2026-09-26T09:05:36.402Z' exploitAvailable: true vendor: Red Hat product: Red Hat JBoss EAP 7.4 ELS for RHEL 8 affected: - amq_broker 7 - build_of_optaplanner 8 - fuse 7 - jboss_enterprise_application_platform 7 - process_automation 7 - single_sign_on 7 - jboss_enterprise_application_platform_7_1_eus_for_rhel_7_server - jboss_enterprise_application_platform_7_3_eus_for_rhel_7_server - jboss_eap_7_4_els_for_rhel_7_server - jboss_eap_7_4_els_for_rhel 8 - jboss_eap_7_4_els_for_rhel 9 - jboss_enterprise_application_platform 7.4.24 patched: - jboss_enterprise_application_platform_7_1_eus_for_rhel_7_server - jboss_enterprise_application_platform_7_3_eus_for_rhel_7_server - jboss_eap_7_4_els_for_rhel_7_server - jboss_eap_7_4_els_for_rhel 8 - jboss_eap_7_4_els_for_rhel 9 - jboss_enterprise_application_platform 7.4.24 ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-01-24T04:55:25.177681Z' --- ## Overview A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:6012** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6012) - **RHSA-2026:6011** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6011) - **RHSA-2026:4915** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4915) - **RHSA-2026:4916** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 8 · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4916) - **RHSA-2026:4917** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 9 · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4917) - **RHSA-2026:4924** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.4.24 · released 2026-03-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:4924) - **Red Hat VEX** · Important · affected: Red Hat AMQ Broker 7, Red Hat build of OptaPlanner 8, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat Process Automation 7, Red Hat Single Sign-On 7 · no fix planned: Red Hat build of OptaPlanner 8, Red Hat Fuse 7, Red Hat Process Automation 7, Red Hat Single Sign-On 7, … · updated 2026-09-12 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0603.json)