{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3fd5e0eb-4651-5241-ae3a-f579211f647d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "hibernate-core",
      "purl": "pkg:maven/org.hibernate/hibernate-core@6.0.2.Final-tuxcare.2",
      "type": "library",
      "group": "org.hibernate",
      "bom-ref": "pkg:maven/org.hibernate/hibernate-core@6.0.2.Final-tuxcare.2",
      "version": "6.0.2.Final-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "hibernate-core",
            "purl": "pkg:maven/org.hibernate/hibernate-core@6.0.2.Final",
            "type": "library",
            "group": "org.hibernate",
            "version": "6.0.2.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-14900",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.0.2.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d5728350-188d-5a9c-a42f-996fa15b6011",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-14900 does not affect version 6.0.2.Final-tuxcare.2 of org.hibernate:hibernate-core. not_affected \u2014 Hibernate ORM 6.0.2.Final is not affected by CVE-2019-14900. The SQL injection vulnerability via unsanitized literals in JPA Criteria API was fixed in the upstream release before version 6.0.2.Final was published. The target version properly escapes string literals using Dialect.appendLiteral() which doubles single quotes (standard SQL escaping), preventing SQL injection when literals are used ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-25638",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.0.2.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ee357f9c-f28a-5fd4-887f-ad58aa29f781",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-25638 does not affect version 6.0.2.Final-tuxcare.2 of org.hibernate:hibernate-core. CVE-2020-25638 is not present in hibernate-orm 6.0.2.Final. The vulnerability was fixed in upstream commit 59fede7aca (authored by Andrea Boriero on 2020-09-29), which was already included in the 6.0.2.Final release before TuxCare onboarded it. The fix adds the Dialect.escapeComment() method that escapes SQL comment delimiters (/* and */) in user-controlled strings before embedding them in SQL comments, preventing SQL injection via comment breakout.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0.Final, < 5.4.24.Final; < 5.3.20.Final), NVD (< 5.3.20; >= 5.4.0, < 5.4.24), cve.org (< 5.4.24.Final), Snyk (< 5.4.24.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-0603",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.0.2.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c5f954e0-e2d1-58b0-bc37-445a0e6814c7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-0603 does not affect version 6.0.2.Final-tuxcare.2 of org.hibernate:hibernate-core. Hibernate 6.0.2.Final is not affected by CVE-2026-0603. The vulnerability pattern exists only in Hibernate 5.x's IdsClauseBuilder class, which uses unsafe String.valueOf() for non-LiteralType ID values in bulk operations with inline IDs. This class does not exist in Hibernate 6.0.2.Final\u2014the entire hql/spi/id/inline package was removed in the Hibernate 5\u21926 architectural rewrite. Hibernate 6 uses temporary tables or subqueries for bulk operations and routes all literal rendering through JdbcLiteralFormatter.appendJdbcLiteral(), which delegates to Dialect.appendLiteral() for proper SQL escaping (doubles single quotes). The vulnerable code path cannot be reached.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.8, < 5.3.38), Snyk (< 5.3.38).",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.hibernate/hibernate-core@6.0.2.Final-tuxcare.2"
    }
  ]
}