{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ee9601c7-ca23-528a-855b-6dcadaf39717",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "hibernate-validator",
      "purl": "pkg:maven/org.hibernate/hibernate-validator@5.0.0.Final-tuxcare.1",
      "type": "library",
      "group": "org.hibernate",
      "bom-ref": "pkg:maven/org.hibernate/hibernate-validator@5.0.0.Final-tuxcare.1",
      "version": "5.0.0.Final-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "hibernate-validator",
            "purl": "pkg:maven/org.hibernate/hibernate-validator@5.0.0.Final",
            "type": "library",
            "group": "org.hibernate",
            "version": "5.0.0.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2014-3558",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-validator@5.0.0.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b36b78d6-efc6-5879-84ed-ad31f915fe7b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3558 affects version 5.0.0.Final-tuxcare.1 of org.hibernate:hibernate-validator."
      }
    },
    {
      "id": "CVE-2017-7536",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-validator@5.0.0.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d2dda608-1ab3-51ab-95bb-a948c67468a1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2017-7536 affects version 5.0.0.Final-tuxcare.1 of org.hibernate:hibernate-validator."
      }
    },
    {
      "id": "CVE-2019-10219",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-validator@5.0.0.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:179e5a97-fb54-58c2-8a27-e7fb295b8aa5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-10219 does not affect version 5.0.0.Final-tuxcare.1 of org.hibernate:hibernate-validator. not_affected \u2014 Version 5.0.0.Final is NOT affected by CVE-2019-10219. The vulnerability was introduced in version 5.1.1.Final (May 2014) when the getFragmentAsDocument method was added. Version 5.0.0.Final (released April 2013) uses a simpler implementation with Jsoup.isValid() that predates the vulnerable code path. No backport to 5.0.x versions exists, confirming this version is not affected.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-10693",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-validator@5.0.0.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7057a39a-8f83-5721-a272-5347ebc61fb8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-10693 does not affect version 5.0.0.Final-tuxcare.1 of org.hibernate:hibernate-validator. not_affected \u2014 Version 5.0.0.Final is NOT AFFECTED by CVE-2020-10693. This version uses a regex-based message interpolation parser (released April 2013), while the vulnerability exists in the state machine parser that was introduced later (May 2013, commit 7bd69df1e). The vulnerable code path (ELState.handleEscapeCharacter) does not exist in 5.0.0.Final. TuxCare backported this CVE to versions 5.4.3.Final and...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-1932",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-validator@5.0.0.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7176946c-79da-54ea-8858-57f3312187e9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-1932 is fixed in version 5.0.0.Final-tuxcare.1 of org.hibernate:hibernate-validator."
      }
    },
    {
      "id": "CVE-2025-15104",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-validator@5.0.0.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:49934f30-8c73-5728-aa29-996556213be6",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-15104 is a false positive for org.hibernate:hibernate-validator 5.0.0.Final-tuxcare.1. false_positive \u2014 CVE-2025-15104 describes a Server-Side Request Forgery (SSRF) vulnerability in Nu Html Checker (validator.nu) - an HTML document validation web service. However, this repository is Hibernate Validator (org.hibernate:hibernate-validator-parent:5.0.0.Final) - a completely different product that implements JSR-349 Bean Validation 1.1 for JavaBean constraint validation. Despite both having \"validat..."
      }
    },
    {
      "id": "CVE-2025-35036",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-validator@5.0.0.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ce4957ea-696d-5c91-b60d-a61c4cc55968",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-35036 affects version 5.0.0.Final-tuxcare.1 of org.hibernate:hibernate-validator."
      }
    },
    {
      "id": "CVE-2026-93879",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-validator@5.0.0.Final-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0044f411-641b-57e2-89b8-9bcf321bf100",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-93879 affects version 5.0.0.Final-tuxcare.1 of org.hibernate:hibernate-validator."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.hibernate/hibernate-validator@5.0.0.Final-tuxcare.1"
    }
  ]
}