Overview

Hibernate ORM has long been a foundational framework for enterprise Java persistence and ORM, powering many business-critical applications. However, many deployments still rely on versions that no longer receive active community maintenance, increasing their exposure to security vulnerabilities. IBM Library Support for Hibernate addresses this gap by providing ongoing security updates and critical CVE remediation, enabling organizations to maintain and secure their Hibernate-based applications while continuing to run their existing environments without disruption.

The importance of Hibernate

Hibernate ORM plays a critical role in enterprise Java development by simplifying the interaction between applications and relational databases. It provides an Object-Relational Mapping (ORM) framework that allows developers to map Java objects to database tables, reducing the need for complex SQL and extensive boilerplate code. Hibernate improves developer productivity, enhances application maintainability, and offers powerful features such as caching, transaction management, and automatic schema generation. Because of its reliability, scalability, and strong integration with frameworks like Spring Framework and Spring Boot, Hibernate has become a foundational technology powering many business-critical enterprise applications.

Supported editions and versions

​The following Hibernate versions are currently supported:

  • IBM Library Support for Hibernate 5.6.x

    ​Latest available version: 5.6.15.SP1

    Version 5.6.x covers the following Maven artifacts:

    • org.hibernate:hibernate-core (pom, jar, javadoc.jar, sources.jar)
    • org.hibernate:hibernate-ehcache (pom, jar, javadoc.jar, sources.jar)
    • org.hibernate:hibernate-entitymanager (pom, jar, javadoc.jar, sources.jar)
    • org.hibernate:hibernate-envers (pom, jar, javadoc.jar, sources.jar)
    • org.hibernate:hibernate-java8 (pom, jar, javadoc.jar, sources.jar)
    • org.hibernate:hibernate-jcache (pom, jar, javadoc.jar, sources.jar)
    • org.hibernate:hibernate-jpamodelgen (pom, jar, javadoc.jar, sources.jar)
    • org.hibernate:hibernate-micrometer (pom, jar, javadoc.jar, sources.jar)

  • IBM Library Support for Hibernate 6.4.x

    ​Latest available version: 6.4.10.SP1

    Version 6.4.x covers the following Maven artifacts:

    • org.hibernate.orm:hibernate-platform (pom, for dependency management)
    • org.hibernate.orm:hibernate-core (pom, jar, javadoc.jar, sources.jar)
    • org.hibernate.orm:hibernate-envers (pom, jar, javadoc.jar, sources.jar)
    • org.hibernate.orm:hibernate-jcache (pom, jar, javadoc.jar, sources.jar)
    • org.hibernate.orm:hibernate-jfr (pom, jar, javadoc.jar, sources.jar)
    • org.hibernate.orm:hibernate-jpamodelgen (pom, jar, javadoc.jar, sources.jar)
    • org.hibernate.orm:hibernate-micrometer (pom, jar, javadoc.jar, sources.jar)
    • org.hibernate.orm:hibernate-vector (pom, jar, javadoc.jar, sources.jar)
    • org.hibernate:hibernate-core (pom, relocation only)
    • org.hibernate:hibernate-envers (pom, relocation only)
    • org.hibernate:hibernate-jcache (pom, relocation only)
    • org.hibernate:hibernate-jfr (pom, relocation only)
    • org.hibernate:hibernate-jpamodelgen (pom, relocation only)
    • org.hibernate:hibernate-micrometer (pom, relocation only)
    • org.hibernate:hibernate-vector (pom, relocation only)
Note: Support is not provided for the following external components that Hibernate ORM integrates with:
  • JDBC drivers
  • Ehcache through hibernate-ehcache
  • Micrometer through hibernate-micrometer

Security updates

IBM Library Support for Hibernate​​​​ provides security updates and vulnerability information for supported Hibernate versions.

​For more details about the CVE listed in the following table, click the link in the Security bulletin column.

Version Security bulletin CVEs addressed
5.6 https://www.ibm.com/support/pages/node/7269283 CVE-2026-0603