{"id":"CVE-2021-43608","aliases":["EUVD-2021-2388","GHSA-r7cj-8hjg-x622","UBUNTU-CVE-2021-43608"],"status":"published","title":"DBAL 3 SQL Injection Security Vulnerability","description":"Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02447,"percentile":0.84563,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2021-11-16T17:25:57Z","modified":"2026-10-20T10:54:11Z","fixes":[{"ecosystem":"Packagist","package":"doctrine/dbal","fixed_in":["3.1.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"doctrine/dbal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"doctrine/dbal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}],"versions":["3.0.0","3.1.0","3.1.1","3.1.2","3.1.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php-doctrine-dbal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.4-2","2.4.5-1","2.4.5-1ubuntu1","2.4.5-2","2.4.5-2build1"]}],"products":[{"vendor":"doctrine-project","product":"database_abstraction_layer"}],"references":[{"url":"https://github.com/doctrine/dbal/commit/9dcfa4cb6c03250b78a84737ba7ceb82f4b7ba4d","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.doctrine-project.org/2021/11/11/dbal3-vulnerability-fixed.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/doctrine/dbal/releases","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/doctrine/dbal/security/advisories/GHSA-r7cj-8hjg-x622","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43608","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/dbal/CVE-2021-43608.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r7cj-8hjg-x622"},{"url":"https://github.com/doctrine/dbal","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-43608","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43608","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-43608","description":"Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.","status":"published","published":"2021-12-09T19:02:59Z","modified":"2024-08-04T04:03:08.429Z","updated_at":"2026-11-02T14:32:56.689433Z"}],"euvd":[{"id":"EUVD-2021-2388","description":"Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.","status":"published","published":"2021-12-09T19:02:59Z","modified":"2024-08-04T04:03:08Z","updated_at":"2026-11-03T03:24:13.772922Z"}],"ghsa":[{"id":"GHSA-r7cj-8hjg-x622","title":"DBAL 3 SQL Injection Security Vulnerability","description":"We have released a new version Doctrine DBAL 3.1.4 that fixes a critical SQL injection vulnerability in the LIMIT clause generation API provided by the Platform abstraction.\n\nWe advise everyone using Doctrine DBAL 3.0.0 up to 3.1.3 to upgrade to 3.1.4 immediately.\n\nThe vulnerability can happen when unsanitized input is passed to many APIs in Doctrine DBAL and ORM that ultimately end up calling `AbstractPlatform::modifyLimitQuery`. \n\nAs a workaround you can cast all limit and offset parameters to integers before passing them to Doctrine APIs.\n\nThis vulnerability has been assigned [CVE-2021-43608](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43608).\n","status":"published","published":"2021-11-16T17:25:57Z","modified":"2024-02-06T11:57:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:36.076201Z"}],"nvd":[{"id":"CVE-2021-43608","description":"Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.","status":"published","published":"2021-12-09T20:15:07.937Z","modified":"2026-06-17T04:11:11.217Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:07:02.189991Z"}],"osv":[{"id":"CVE-2021-43608","description":"Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.","status":"published","published":"2021-12-09T20:15:07.937Z","modified":"2026-10-20T10:54:11.868671219Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"GHSA-r7cj-8hjg-x622","title":"DBAL 3 SQL Injection Security Vulnerability","description":"We have released a new version Doctrine DBAL 3.1.4 that fixes a critical SQL injection vulnerability in the LIMIT clause generation API provided by the Platform abstraction.\n\nWe advise everyone using Doctrine DBAL 3.0.0 up to 3.1.3 to upgrade to 3.1.4 immediately.\n\nThe vulnerability can happen when unsanitized input is passed to many APIs in Doctrine DBAL and ORM that ultimately end up calling `AbstractPlatform::modifyLimitQuery`. \n\nAs a workaround you can cast all limit and offset parameters to integers before passing them to Doctrine APIs.\n\nThis vulnerability has been assigned [CVE-2021-43608](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43608).\n","status":"published","published":"2021-11-16T17:25:57Z","modified":"2026-07-08T06:28:09.549082612Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"UBUNTU-CVE-2021-43608","description":"Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.","status":"published","published":"2021-12-09T20:15:00Z","modified":"2025-10-24T04:50:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:29.220315Z"}]}}