{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0c27db52-3a75-5ed0-a9e1-3725a1faac61",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "hibernate-validator",
      "purl": "pkg:maven/org.hibernate.validator/hibernate-validator@6.2.5.Final-tuxcare.2",
      "type": "library",
      "group": "org.hibernate.validator",
      "bom-ref": "pkg:maven/org.hibernate.validator/hibernate-validator@6.2.5.Final-tuxcare.2",
      "version": "6.2.5.Final-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "hibernate-validator",
            "purl": "pkg:maven/org.hibernate.validator/hibernate-validator@6.2.5.Final",
            "type": "library",
            "group": "org.hibernate.validator",
            "version": "6.2.5.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10219",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate.validator/hibernate-validator@6.2.5.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e496d9cc-1117-5411-89a0-5d9c8e05edb4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10219 does not affect version 6.2.5.Final-tuxcare.2 of org.hibernate.validator:hibernate-validator. not_affected \u2014 The target version 6.2.5.Final is not affected by CVE-2019-10219. The vulnerable @SafeHtml constraint validator was completely removed from the upstream codebase in version 6.2.0.CR1 (July 2020) via commit 55a24f336 by upstream maintainer Guillaume Smet. This removal occurred before TuxCare onboarded version 6.2.5.Final (September 2022). The feature and all associated code no longer exist in th...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10693",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate.validator/hibernate-validator@6.2.5.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1d3f7e90-0dbd-55d1-bddd-1719d83fd26c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10693 does not affect version 6.2.5.Final-tuxcare.2 of org.hibernate.validator:hibernate-validator. not_affected \u2014 CVE-2020-10693 is not present in Hibernate Validator 6.2.5.Final. The vulnerability allowed EL expression injection through the pattern `$\\X{...}` where X is any character, bypassing input sanitization. The upstream fix (commit 6ae28a1bc by yoann@hibernate.org, Feb 2020) modified ELState.handleEscapeCharacter() to transition to MessageState instead of returning to ELState after escape processin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-1932",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate.validator/hibernate-validator@6.2.5.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4ca93592-338f-5341-8737-7ade5b5b126f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-1932 does not affect version 6.2.5.Final-tuxcare.2 of org.hibernate.validator:hibernate-validator. not_affected \u2014 hibernate-validator 6.2.5.Final is not affected by CVE-2023-1932. The vulnerable SafeHtml constraint and SafeHtmlValidator were completely removed by the upstream project in version 6.2.0 (commit 55a24f3368, July 2020), well before version 6.2.5.Final was released (September 2022). The entire @SafeHtml validation feature, including the vulnerable isValid() method, no longer exists in the target...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-15104",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate.validator/hibernate-validator@6.2.5.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c20879e1-e6d3-531c-9b6b-b944f981fe43",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-15104 is a false positive for org.hibernate.validator:hibernate-validator 6.2.5.Final-tuxcare.2. direct vulnerability is in Nu Html Checker (validator.nu) project"
      }
    },
    {
      "id": "CVE-2025-35036",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate.validator/hibernate-validator@6.2.5.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b35a6710-6c30-5305-a4de-12b49787dcb3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-35036 does not affect version 6.2.5.Final-tuxcare.2 of org.hibernate.validator:hibernate-validator. not_affected \u2014 CVE-2025-35036 describes an Expression Language (EL) injection vulnerability in Hibernate Validator before 6.2.0 and 7.0.0, where user-supplied input in custom constraint violation messages could be interpolated with EL, enabling arbitrary code execution or information disclosure. The target version 6.2.5.Final already contains the upstream fix introduced in version 6.2.0 (commits e076293b0 and...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-93879",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate.validator/hibernate-validator@6.2.5.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:70252aa0-b7a0-5292-98ae-2ce4f3fae971",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-93879 affects version 6.2.5.Final-tuxcare.2 of org.hibernate.validator:hibernate-validator."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.hibernate.validator/hibernate-validator@6.2.5.Final-tuxcare.2"
    }
  ]
}