← Back to CVEs
CVE-2026-0603
HIGH8.3
Description
A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.
CVE Details
CVSS v3.1 Score8.3
SeverityHIGH
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
Published1/23/2026
Last Modified3/30/2026
Sourcenvd
Honeypot Sightings0
Weaknesses (CWE)
CWE-89
References
https://access.redhat.com/errata/RHSA-2026:4915(secalert@redhat.com)
https://access.redhat.com/errata/RHSA-2026:4916(secalert@redhat.com)
https://access.redhat.com/errata/RHSA-2026:4917(secalert@redhat.com)
https://access.redhat.com/errata/RHSA-2026:4924(secalert@redhat.com)
https://access.redhat.com/errata/RHSA-2026:6011(secalert@redhat.com)
https://access.redhat.com/errata/RHSA-2026:6012(secalert@redhat.com)
https://access.redhat.com/security/cve/CVE-2026-0603(secalert@redhat.com)
https://bugzilla.redhat.com/show_bug.cgi?id=2427147(secalert@redhat.com)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.