CVE-2024-49203
Published Nov 20, 2024
Modified Apr 15, 2026
Description
Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction.
Is your site exposed to CVE-2024-49203?
Run a free security scan — no signup, results in seconds.
References
Other References
https://github.com/OpenFeign/querydsl/
https://github.com/OpenFeign/querydsl/pull/742
https://github.com/OpenFeign/querydsl/pull/743
https://github.com/OpenFeign/querydsl/releases/tag/5.6.1
https://github.com/OpenFeign/querydsl/releases/tag/6.10.1
https://github.com/advisories/GHSA-6q3q-6v5j-h6vg
https://github.com/querydsl/querydsl/issues/3757
https://github.com/querydsl/querydsl/releases/tag/QUERYDSL_5_1_0
https://github.com/spring-projects/spring-data-jpa/issues/3693
https://www.csirt.sk/querydsl-java-library-vulnerability-permits-sql-hql-injection.html
Frequently Asked Questions
What is CVE-2024-49203? +
Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction.
How do I check if I'm vulnerable to CVE-2024-49203? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.