The CVE for this implies this issue is fixed in 5.3.18, but this issue is not marked as fixed in that version (and that version does not appear to have been released).

Is 5.3 affected, and if so, is it planned to backport a fix for this to that branch? Right now, I don’t see an equivalent to https://github.com/hibernate/hibernate-orm/commit/3f3c1ab50604ab9ba99e25d2016fb85f3ba9dcd4 on the 5.3 branch.