Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hibernate/hibernate-orm

              main @ 04b1f89
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

hibernate-core: most-fixed (8 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Inconsistent multi-tenancy validation across stateless sessions, child sessions, and filters allows cross-tenant data access if tenant identifiers are not properly resolved, enforced, or if they are modified on shared connections.

SQL Injection: Vulnerabilities in the JPA Criteria API and query generation (such as raw string formatting or comment appending) allow SQL injection. Secure rendering relies strictly on dialect-level inline literal formatting.

Information Disclosure: Exposing sensitive configuration properties (like user passwords) via SessionFactory metadata or logging requires mandatory masking and redaction during initialization.