{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a02cb652-1770-5176-8d21-9d490d4df7c4",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "hibernate-core",
      "purl": "pkg:maven/org.hibernate/hibernate-core@6.2.20.Final-tuxcare.2",
      "type": "library",
      "group": "org.hibernate",
      "bom-ref": "pkg:maven/org.hibernate/hibernate-core@6.2.20.Final-tuxcare.2",
      "version": "6.2.20.Final-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "hibernate-core",
            "purl": "pkg:maven/org.hibernate/hibernate-core@6.2.20.Final",
            "type": "library",
            "group": "org.hibernate",
            "version": "6.2.20.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-14900",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.2.20.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2da4f751-c6f0-5146-b3eb-19a5aeab8795",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-14900 does not affect version 6.2.20.Final-tuxcare.2 of org.hibernate:hibernate-core. not_affected \u2014 Target version 6.2.20.Final is NOT AFFECTED by CVE-2019-14900. The SQL injection vulnerability in JPA Criteria API literal handling was fixed in the upstream Hibernate project and shipped in version 6.2.20.Final before TuxCare onboarded it. The vulnerable code pattern (direct string concatenation without escaping) has been replaced with proper literal escaping via dialect.appendLiteral() which ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-25638",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.2.20.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:06e39e53-7a0b-5323-839c-77a9abafc6a6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-25638 does not affect version 6.2.20.Final-tuxcare.2 of org.hibernate:hibernate-core. CVE-2020-25638 is not present in Hibernate ORM 6.2.20.Final-tuxcare.1. The vulnerability (SQL injection via unescaped SQL comment delimiters when use_sql_comments is enabled) was fixed by upstream commit 59fede7aca authored by andrea@hibernate.org. This fix was already present in the upstream 6.2.20.Final release that TuxCare onboarded. The escapeComment() defense properly escapes `*/` and `/*` delimiters in all SQL statement builders (Dialect.java, Delete.java, Insert.java, Update.java, SimpleSelect.java, AbstractSqlAstTranslator.java), preventing comment breakout attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0.Final, < 5.4.24.Final; < 5.3.20.Final), NVD (< 5.3.20; >= 5.4.0, < 5.4.24), cve.org (< 5.4.24.Final), Snyk (< 5.4.24.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-0603",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.2.20.Final-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:68529d97-ccd2-554a-b9c1-c4a806cb41f8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-0603 does not affect version 6.2.20.Final-tuxcare.2 of org.hibernate:hibernate-core. CVE-2026-0603 describes a SQL injection vulnerability in Hibernate where unsanitized special characters (particularly single quotes) in ID columns can be exploited when InlineIdsOrClauseBuilder is used. The target version (Hibernate ORM 6.2.20.Final-tuxcare.1) is NOT AFFECTED because the vulnerable pattern was already fixed in the upstream release. Version 6.x refactored the architecture, replacing the vulnerable InlineIdsOrClauseBuilder (version 5.x) with InlineMutationStrategy and InPredicateRestrictionProducer that use JdbcLiteral objects. String literals are rendered via JdbcLiteralFormatter which calls Dialect.appendLiteral(), properly escaping single quotes by doubling them. The fix for CVE-2019-14900 (HHH-14077, commit eebf01fbf3) addressing the same vulnerability class was already present in the upstream 6.2.20.Final release that TuxCare onboarded, authored by andrea@hibernate.org.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.8, < 5.3.38), Snyk (< 5.3.38).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.hibernate/hibernate-core@6.2.20.Final-tuxcare.2"
    }
  ]
}