Hello, we faced with issue that our project is failed BlackDuck scan because antlr4-runtime (up to 4.13.2 version) has HIGH security vulnerability (https://vuldb.com/cve/CVE-2026-13500?__cf_chl_f_tk=WOWgkFwrogOqMNyW08JkcjXmlc9FRsyNZYono1yCgTU-1783347438-1.0.1.1-fSgWnplnJSwNI8k0cbWUkIy.aK6Ba1ZbRuYyoNtwMKw)
Is there any plan to step away from using this library in hibernate-core?
Hibernate ORM is not directly affected by this problem, also see the discussion on the ANTLR issue tracker: CVE-2026-13500 Resolution · Issue #4952 · antlr/antlr4 · GitHub
This is only a problem for applications that invoke the ANTLR tool with an untrusted grammar, which Hibernate ORM does not do. It only requires the ANTLR runtime and the grammar is trusted, since it’s part of the Hibernate ORM repository. Also see antlr4_001_Code_Injection_via_Grammar_Actions · Issue #4 · wooyun123/wooyun · GitHub
Thank you for complete answer!