{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7dda40b4-2236-5b7c-a230-150c69247f90",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "hibernate-core",
      "purl": "pkg:maven/org.hibernate/hibernate-core@6.1.7.Final-tuxcare.2",
      "type": "library",
      "group": "org.hibernate",
      "bom-ref": "pkg:maven/org.hibernate/hibernate-core@6.1.7.Final-tuxcare.2",
      "version": "6.1.7.Final-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "hibernate-core",
            "purl": "pkg:maven/org.hibernate/hibernate-core@6.1.7.Final",
            "type": "library",
            "group": "org.hibernate",
            "version": "6.1.7.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-14900",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.1.7.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7bbf8c56-b7ea-59ec-8811-45b7eb5daf7b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-14900 does not affect version 6.1.7.Final-tuxcare.2 of org.hibernate:hibernate-core. not_affected \u2014 CVE-2019-14900 is not present in Hibernate ORM 6.1.7.Final. The vulnerability involved SQL injection through unescaped string literals in JPA Criteria API SELECT/GROUP BY clauses. The upstream fix (commit eebf01fbf3) was applied in Hibernate 5.5.0.Beta1/5.4.18/5.3.18 and is present in the upstream 6.1.7.Final release that TuxCare onboarded. The current code properly escapes single quotes via di...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-25638",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.1.7.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0e5b46e2-611a-5e58-929e-3dc072b1626a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-25638 does not affect version 6.1.7.Final-tuxcare.2 of org.hibernate:hibernate-core. The target repository (Hibernate ORM 6.1.7.Final) is not affected by CVE-2020-25638. The vulnerability fix was already present in the upstream release that TuxCare onboarded. The fix introduces Dialect.escapeComment() to sanitize SQL comment strings by escaping comment-terminating sequences (*/\u2192*\\/) and comment-starting sequences (/*\u2192/\\*), preventing SQL injection when use_sql_comments is enabled. All SQL builders (Insert, Delete, Update, SimpleSelect) properly use this escaping method. The fix commit 59fede7aca was authored by andrea@hibernate.org and is an ancestor of the first TuxCare onboard commit 4b358c3d50.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0.Final, < 5.4.24.Final; < 5.3.20.Final), NVD (< 5.3.20; >= 5.4.0, < 5.4.24), cve.org (< 5.4.24.Final), Snyk (< 5.4.24.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-0603",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.1.7.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cd62a7e7-46f1-57fc-9478-9d708f8a8c35",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-0603 does not affect version 6.1.7.Final-tuxcare.2 of org.hibernate:hibernate-core. Hibernate 6.1.7.Final is NOT affected by CVE-2026-0603. The vulnerable code pattern from Hibernate 5.x (InlineIdsInClauseBuilder with unescaped ID value handling) does not exist in Hibernate 6.x. Hibernate 6.x was architecturally redesigned with a JdbcLiteralFormatter pattern that ensures all literal values, including ID values in bulk operations, are properly escaped through dialect.appendLiteral() which doubles single quotes. The fix was shipped in the upstream 6.1.7.Final release (2023-02-07) as part of the Hibernate 6.x rewrite, predating the HHH-20080 patches (2026-01) which only apply to Hibernate 5.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.8, < 5.3.38), Snyk (< 5.3.38).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.hibernate/hibernate-core@6.1.7.Final-tuxcare.2"
    }
  ]
}