{"id":"GHSA-vjrg-wpm8-rhrw","aliases":["CLSA-2026-1777509602"],"status":"published","title":"doctrine/orm Regression in Query Parenthesis can have Security Implications","description":"An issue identified in doctrine/orm project related to statement in Where-Clause were not wrapped in brackets due to improper hadandling of case insensitive check.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-05-15T20:19:47Z","modified":"2026-10-15T09:47:59Z","fixes":[{"ecosystem":"Packagist","package":"doctrine/orm","fixed_in":["2.8.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"doctrine/orm","fixed_in":["2.8.3-p1+tuxcare"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"doctrine/orm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.3"},{"fixed":"2.8.4"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"doctrine/orm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.3"},{"fixed":"2.8.3-p1+tuxcare"}]}],"versions":["2.8.3"]},{"source":"osv","ecosystem":"Packagist","package":"doctrine/orm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.3"},{"fixed":"2.8.4"}]}],"versions":["2.8.3"]}],"references":[{"url":"https://github.com/doctrine/orm/pull/8591","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/orm/2021-04-06.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vjrg-wpm8-rhrw"},{"url":"https://github.com/doctrine/orm","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-vjrg-wpm8-rhrw","title":"doctrine/orm Regression in Query Parenthesis can have Security Implications","description":"An issue identified in doctrine/orm project related to statement in Where-Clause were not wrapped in brackets due to improper hadandling of case insensitive check.","status":"published","published":"2024-05-15T20:19:47Z","modified":"2024-05-15T20:19:47Z","updated_at":"2026-11-02T14:37:49.48194Z"}],"osv":[{"id":"CLSA-2026-1777509602","title":"TuxCare security update for doctrine/orm (1 CVE)","description":"TuxCare rebuilt doctrine/orm to address 1 CVE. Fixed in 2.8.3-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:47:59.574142786Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"GHSA-vjrg-wpm8-rhrw","title":"doctrine/orm Regression in Query Parenthesis can have Security Implications","description":"An issue identified in doctrine/orm project related to statement in Where-Clause were not wrapped in brackets due to improper hadandling of case insensitive check.","status":"published","published":"2024-05-15T20:19:47Z","modified":"2024-11-29T05:42:43.555345Z","updated_at":"2026-11-02T15:46:57.348035Z"}]}}