org.hibernate/hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection

🗓️ 18 Mar 2026 13:54:46Reported by RedHatType

Hibernate core vulnerability enables data disclosure and deletion via second-order SQL injection with crafted IDs in InlineIdsOrClauseBuilder.

Reporter	Title	Published	Views	Family All 43
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	2 Mar 202606:11	–	ibm
IBM Security Bulletins	Security Bulletin: Remediation of Hibernate Vulnerability in IBM Library Support for Hibernate	13 Apr 202615:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	7 May 202613:57	–	ibm
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the Hibernate library	10 Apr 202613:46	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of hibernate-core. IBM webMethods BPM is vulnerable to a second-order SQL injection	27 Mar 202608:03	–	ibm
ATTACKERKB	CVE-2026-0603	23 Jan 202606:31	–	attackerkb
Circl	CVE-2026-0603	23 Jan 202608:41	–	circl
CNNVD	Hibernate security vulnerability	19 Jan 202600:00	–	cnnvd
CVE	CVE-2026-0603	23 Jan 202606:31	–	cve
Cvelist	CVE-2026-0603 Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection	23 Jan 202606:31	–	cvelist

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-0603
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-0603
cve	www.cve.org/CVERecord

05 May 2026 14:43Current

6Medium risk

Vulners AI Score6

CVSS 3.18.3

EPSS0.00782

SSVC