Hibernate ORM 7.4

Apply the Java 25 baseline first. These rules cover Hibernate ORM 7.4.7.Final query construction, sessions, tenancy, transactions, caches, and schema behavior.

Query construction and result bounds

• Bind every HQL, JPQL, criteria, and native SQL value; allowlist identifiers, functions, operators, sort directions, projections, and fragments that cannot be parameters.
• Never concatenate request input into createQuery, createNativeQuery, @SQLRestriction, filters, or stored-procedure syntax even when the value passed validation elsewhere.
• Set hibernate.query.fail_on_pagination_over_collection_fetch=true; its false default can turn a paginated collection fetch into unbounded in-memory pagination. Avoid org.hibernate.limitInMemory, which bypasses this guard for list results.
• Set query timeouts and maximum results on all attacker-influenced searches, and bound joins, fetch graphs, batch sizes, and result serialization.
• Keep hibernate.allow_update_outside_transaction=false; enabling it permits update/delete query execution without an active transaction.

Entity state and write control

• Map request DTOs explicitly to entities and never pass an attacker-populated detached graph to Session.merge, which copies its state into a managed instance.
• Load the authorized managed entity inside the transaction, recheck tenant/owner/version, then assign only fields allowed for that transition.
• Use optimistic @Version checks or deliberate pessimistic locks for security-sensitive races and handle stale updates without blind automatic replay.
• Remember that