CVE-2026-0603

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Jan 23, 2026
Source updated: Oct 6, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

org.hibernate/hibernate-core

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: unaffected
Package: org.hibernate/hibernate-core
Package collection: https://github.com/hibernate/hibernate-orm

org.hibernate/hibernate-core · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
5.2.8	`affected`	semver	Unavailable	5.6.15	None listed

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
Platforms: Unknown
Default status: affected
Package: eap7-hibernate
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:5.1.17-4.Final_redhat_00005.1.ep7.el7	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
Platforms: Unknown
Default status: affected
Package: eap7-wildfly
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:7.1.14-4.GA_redhat_00003.1.ep7.el7	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
Platforms: Unknown
Default status: affected
Package: eap7-hibernate
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:5.3.38-1.Final_redhat_00001.1.el7eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
Platforms: Unknown
Default status: affected
Package: eap7-wildfly
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:7.3.17-5.GA_redhat_00006.1.el7eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4.24

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4.24
Platforms: Unknown
Default status: affected
Package: org.hibernate/hibernate-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4.24 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
5.3.38.Final-redhat-00001	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Platforms: Unknown
Default status: affected
Package: eap7-hibernate
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:5.3.38-1.Final_redhat_00001.1.el7eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Platforms: Unknown
Default status: affected
Package: eap7-wildfly
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:7.4.24-4.GA_redhat_00002.1.el7eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
Platforms: Unknown
Default status: affected
Package: eap7-hibernate
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:5.3.38-1.Final_redhat_00001.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
Platforms: Unknown
Default status: affected
Package: eap7-wildfly
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:7.4.24-4.GA_redhat_00002.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
Platforms: Unknown
Default status: affected
Package: eap7-hibernate
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:5.3.38-1.Final_redhat_00001.1.el9eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
Platforms: Unknown
Default status: affected
Package: eap7-wildfly
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:7.4.24-4.GA_redhat_00002.1.el9eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Single Sign-On 7.6.13

Vendor: Red Hat
Product: Red Hat Single Sign-On 7.6.13
Platforms: Unknown
Default status: unaffected
Package: hibernate-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Single Sign-On 7.6 for RHEL 7

Vendor: Red Hat
Product: Red Hat Single Sign-On 7.6 for RHEL 7
Platforms: Unknown
Default status: affected
Package: rh-sso7-keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Single Sign-On 7.6 for RHEL 7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:18.0.20-1.redhat_00001.1.el7sso	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Single Sign-On 7.6 for RHEL 8

Vendor: Red Hat
Product: Red Hat Single Sign-On 7.6 for RHEL 8
Platforms: Unknown
Default status: affected
Package: rh-sso7-keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Single Sign-On 7.6 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:18.0.20-1.redhat_00001.1.el8sso	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Single Sign-On 7.6 for RHEL 9

Vendor: Red Hat
Product: Red Hat Single Sign-On 7.6 for RHEL 9
Platforms: Unknown
Default status: affected
Package: rh-sso7-keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Single Sign-On 7.6 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:18.0.20-1.redhat_00001.1.el9sso	`unaffected`	rpm	*	Unavailable	None listed

RHEL-8 based Middleware Containers

Vendor: Red Hat
Product: RHEL-8 based Middleware Containers
Platforms: Unknown
Default status: affected
Package: rh-sso-7/sso76-openshift-rhel8
Package collection: https://catalog.redhat.com/software/containers/

RHEL-8 based Middleware Containers · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
7.6-85	`unaffected`	rpm	*	Unavailable	None listed

Red Hat AMQ Broker 7

Vendor: Red Hat
Product: Red Hat AMQ Broker 7
Platforms: Unknown
Default status: affected
Package: hibernate-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of OptaPlanner 8

Vendor: Red Hat
Product: Red Hat build of OptaPlanner 8
Platforms: Unknown
Default status: affected
Package: hibernate-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Data Grid 8

Vendor: Red Hat
Product: Red Hat Data Grid 8
Platforms: Unknown
Default status: unaffected
Package: hibernate-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Fuse 7

Vendor: Red Hat
Product: Red Hat Fuse 7
Platforms: Unknown
Default status: affected
Package: hibernate-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform 7

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7
Platforms: Unknown
Default status: affected
Package: hibernate-core
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8
Platforms: Unknown
Default status: unaffected
Package: hibernate-core
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform Expansion Pack

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform Expansion Pack
Platforms: Unknown
Default status: unaffected
Package: hibernate-core
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat OpenShift AI (RHOAI)

Vendor: Red Hat
Product: Red Hat OpenShift AI (RHOAI)
Platforms: Unknown
Default status: unaffected
Package: rhoai/odh-trustyai-service-rhel8
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat OpenShift AI (RHOAI)

Vendor: Red Hat
Product: Red Hat OpenShift AI (RHOAI)
Platforms: Unknown
Default status: unaffected
Package: rhoai/odh-trustyai-service-rhel9
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat OpenShift Dev Spaces

Vendor: Red Hat
Product: Red Hat OpenShift Dev Spaces
Platforms: Unknown
Default status: unaffected
Package: devspaces/openvsx-rhel9
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat OpenShift Dev Spaces

Vendor: Red Hat
Product: Red Hat OpenShift Dev Spaces
Platforms: Unknown
Default status: unaffected
Package: devspaces/pluginregistry-rhel9
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Process Automation 7

Vendor: Red Hat
Product: Red Hat Process Automation 7
Platforms: Unknown
Default status: affected
Package: hibernate-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Satellite 6

Vendor: Red Hat
Product: Red Hat Satellite 6
Platforms: Unknown
Default status: unaffected
Package: candlepin
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Satellite 6

Vendor: Red Hat
Product: Red Hat Satellite 6
Platforms: Unknown
Default status: unaffected
Package: satellite:el8/candlepin
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.