DBAL 3 SQL Injection Security Vulnerability
Published 16 Nov 2021 · Updated 8 Jul 2026
Affected package
- Affected
- >=3.0.0 <3.1.4
- Fixed in
- 3.1.4
composer require doctrine/dbal:^3.1.4Details
We have released a new version Doctrine DBAL 3.1.4 that fixes a critical SQL injection vulnerability in the LIMIT clause generation API provided by the Platform abstraction.
We advise everyone using Doctrine DBAL 3.0.0 up to 3.1.3 to upgrade to 3.1.4 immediately.
The vulnerability can happen when unsanitized input is passed to many APIs in Doctrine DBAL and ORM that ultimately end up calling AbstractPlatform::modifyLimitQuery.
As a workaround you can cast all limit and offset parameters to integers before passing them to Doctrine APIs.
This vulnerability has been assigned CVE-2021-43608.
Is GHSA-r7cj-8hjg-x622 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected doctrine/dbal, and gives you the command that fixes it.
References
- Linkgithub.com/doctrine/dbal/security/advisories/GHSA-r7cj-8hjg-x622
- Advisorynvd.nist.gov/vuln/detail/CVE-2021-43608
- Linkgithub.com/doctrine/dbal/commit/9dcfa4cb6c03250b78a84737ba7ceb82f4b7ba4d
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/doctrine/dbal/CVE-2021-43608.yaml
- Linkgithub.com/doctrine/dbal
- Linkgithub.com/doctrine/dbal/releases
- Linkwww.doctrine-project.org/2021/11/11/dbal3-vulnerability-fixed.html
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.