Skip to content
Fencer Vulns
high 8.2

CVE-2024-49203 json

Querydsl vulnerable to HQL injection through orderBy

published 2024-11-20 23 mo ago modified 2026-06-17 4 mo ago also GHSA-6q3q-6v5j-h6vg , EUVD-2024-3393

cvss
8.2
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction.

Patch / fix

  • maven io.github.openfeign.querydsl:querydsl-jpa 5.6.1, 6.10.1
  • maven io.github.openfeign.querydsl:querydsl-apt 5.6.1, 6.10.1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
23 mo ago

Exploit prediction

0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
GitHub 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Affected packages

ecosystem package affected fixed in
maven io.github.openfeign.querydsl:querydsl-jpa
>=6.0.0.M1, <6.10.1
<5.6.1
6.10.1
5.6.1
maven io.github.openfeign.querydsl:querydsl-apt
>=6.0.0.M1, <6.10.1
<5.6.1
6.10.1
5.6.1
maven com.querydsl:querydsl-jpa
<=5.1.0
 no fix listed
maven com.querydsl:querydsl-apt
<=5.1.0
 no fix listed

Affected products

  • querydsl querydsl
  • openfeign_querydsl openfeign_querydsl

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.