{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9a675a00-d11a-545b-972c-2f7381670cbf",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "hibernate-core",
      "purl": "pkg:maven/org.hibernate/hibernate-core@6.4.10.Final-tuxcare.3",
      "type": "library",
      "group": "org.hibernate",
      "bom-ref": "pkg:maven/org.hibernate/hibernate-core@6.4.10.Final-tuxcare.3",
      "version": "6.4.10.Final-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "hibernate-core",
            "purl": "pkg:maven/org.hibernate/hibernate-core@6.4.10.Final",
            "type": "library",
            "group": "org.hibernate",
            "version": "6.4.10.Final"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-14900",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.4.10.Final-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:97b16944-c3c7-57f6-9ebf-ce6569f78d71",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2019-14900 does not affect version 6.4.10.Final-tuxcare.3 of org.hibernate:hibernate-core. not_affected \u2014 CVE-2019-14900 is not present in Hibernate ORM 6.4.10.Final-tuxcare.3. The vulnerability (SQL injection via unsanitized literals in JPA Criteria API SELECT/GROUP BY clauses) was fixed in upstream commits 3f3c1ab506 and eebf01fbf3, both shipped in the upstream 6.4.10.Final release before TuxCare onboarding. The target uses the refactored 6.x architecture where all literal rendering routes throug...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2020-25638",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.4.10.Final-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:fb31f96a-a941-5139-9692-7f51f64f157b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-25638 does not affect version 6.4.10.Final-tuxcare.3 of org.hibernate:hibernate-core. Target version 6.4.10.Final is not affected by CVE-2020-25638. The vulnerability (SQL injection via unescaped comment delimiters) was fixed in upstream commit 59fede7acaaa1579b561407aefa582311f7ebe78, which was already included in the upstream 6.4.10.Final release before TuxCare onboarded it. The fix adds Dialect.escapeComment() method that escapes /* and */ characters, and this method is comprehensively applied across both legacy SQL builders and modern AST-based SQL generation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0.Final, < 5.4.24.Final; < 5.3.20.Final), NVD (< 5.3.20; >= 5.4.0, < 5.4.24), cve.org (< 5.4.24.Final), Snyk (< 5.4.24.Final).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-0603",
      "affects": [
        {
          "ref": "pkg:maven/org.hibernate/hibernate-core@6.4.10.Final-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f36acecf-6e6e-52aa-8faf-67c23d76adc8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-0603 does not affect version 6.4.10.Final-tuxcare.3 of org.hibernate:hibernate-core. Hibernate 6.4.10.Final is not affected by CVE-2026-0603. The vulnerability described in the CVE (SQL injection via unescaped special characters in ID columns when using inline ID-based bulk operations) was addressed in upstream Hibernate 6 through architectural changes and the fix for CVE-2019-14900 (commit eebf01fbf3c2550ee70cdc9c1b02b52e330c8c36). The vulnerable code paths from Hibernate 5 (IdsClauseBuilder with String.valueOf) do not exist in Hibernate 6. All string literals, including IDs used in inline mutations, are rendered through Dialect.appendLiteral() which properly escapes single quotes by doubling them.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.8, < 5.3.38), Snyk (< 5.3.38).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.hibernate/hibernate-core@6.4.10.Final-tuxcare.3"
    }
  ]
}