Impact of Hibernate CVE-2026-0603 on Spring Framework and Spring Data

Products

• VMware Tanzu Platform Spring

Issue/Introduction

CVE-2026-0603 is a second-order SQL injection vulnerability identified within the Hibernate ORM library. This vulnerability can occur when an application explicitly opts into the InlineIdsOrClauseBulkIdStrategy optimization strategy for bulk ID operations. If an attacker can craft a primary key (ID) containing malicious SQL and this optimization is active, it may lead to improper SQL execution such as unintended deletion of data.

It is important to note that this is not a vulnerability in the Spring Framework or Spring Data JPA. It is a configuration-dependent vulnerability within a third-party dependency (Hibernate) that may be utilized by applications using these Spring projects.

Cause

Applications are only vulnerable if they have explicitly configured Hibernate to use the vulnerable strategy.

To determine if your application is using this strategy, check your Hibernate configuration for the following property:

hibernate.hql.bulk_id_strategy = org.hibernate.hql.spi.id.inline.InlineIdsOrClauseBulkIdStrategy

If this property is not configured or if it is set to a different strategy, your application is not susceptible to this specific SQL injection path via this strategy.

Resolution

In Hibernate 6.0, the internal query construction engine (Semantic Query Model) was completely rewritten. The vulnerable InlineIdsOrClauseBuilder logic was removed and replaced with safe value handling and parameterization.