{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5a8299ac-2d7d-5063-9acf-0420b989ac9d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "hibernate-core",
      "purl": "pkg:maven/org.hibernate/hibernate-core@5.6.15.Final-tuxcare.10",
      "type": "library",
      "group": "org.hibernate",
      "bom-ref": "pkg:maven/org.hibernate/hibernate-core@5.6.15.Final-tuxcare.10",
      "version": "5.6.15.Final-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "hibernate-core",
            "purl": "pkg:maven/org.hibernate/hibernate-core@5.6.15.Final",
            "type": "library",
            "group": "org.hibernate",
            "version": "5.6.15.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-14900",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@5.6.15.Final-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:ee28f930-9a87-5c0c-9100-2146ebae25a6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-14900 does not affect version 5.6.15.Final-tuxcare.10 of org.hibernate:hibernate-core. not_affected \u2014 CVE-2019-14900 is NOT present in Hibernate ORM 5.6.15.Final-tuxcare.10. The vulnerability (SQL injection via unsanitized literals in JPA Criteria API SELECT/GROUP BY clauses) was fixed by upstream commit 3f3c1ab5060 on 2020-06-18, almost 3 years before the 5.6.15.Final release (2023-02-06). The fix routes Character/String literals through Dialect.inlineLiteral() which properly escapes SQL speci...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-25638",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@5.6.15.Final-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:2c627ca4-7749-5d14-bb34-ee1fcda013f7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-25638 does not affect version 5.6.15.Final-tuxcare.10 of org.hibernate:hibernate-core. CVE-2020-25638 does not affect this version. The upstream fix for SQL injection in SQL comments was already present in Hibernate ORM 5.6.15.Final when TuxCare onboarded it. The escapeComment() method properly sanitizes comment delimiters (/* and */), preventing comment breakout attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0.Final, < 5.4.24.Final; < 5.3.20.Final), NVD (< 5.3.20; >= 5.4.0, < 5.4.24), cve.org (< 5.4.24.Final), Snyk (< 5.4.24.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-0603",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@5.6.15.Final-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:354c5e12-31b2-5f87-bd22-7a1ddd776421",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-0603 is fixed in version 5.6.15.Final-tuxcare.10 of org.hibernate:hibernate-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.hibernate/hibernate-core@5.6.15.Final-tuxcare.10"
    }
  ]
}