{"id":"CVE-2025-64518","aliases":["EUVD-2025-50813","GHSA-6fhj-vr9j-g45r"],"status":"published","title":"CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection","description":"The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00394,"percentile":0.33949,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2025-11-10T21:04:03Z","modified":"2026-10-28T11:00:34Z","fixes":[{"ecosystem":"Maven","package":"org.cyclonedx:cyclonedx-core-java","fixed_in":["11.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.cyclonedx:cyclonedx-core-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"11.0.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.cyclonedx:cyclonedx-core-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"11.0.1"}]}],"versions":["10.0.0","10.1.0","10.2.1","11.0.0","2.1.0","2.1.1","2.5.0","2.5.1","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.7.0","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","4.0.0","4.0.1","4.0.2","4.0.3","4.1.0","4.1.1","4.1.2","5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","6.0.0","7.0.0","7.1.0","7.1.1","7.1.2","7.1.3","7.1.4","7.1.5","7.1.6","7.2.0","7.2.1","7.3.0","7.3.1","7.3.2","8.0.0","8.0.1","8.0.2","8.0.3","9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5","9.1.0"]}],"products":[{"vendor":"cyclonedx","product":"cyclonedx-core-java"}],"references":[{"url":"https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-6fhj-vr9j-g45r","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/CycloneDX/cyclonedx-core-java/pull/737","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/CycloneDX/cyclonedx-core-java/commit/af0ec75c93c03f93733a070c5132554490af5314","tags":["x_refsource_MISC","fix","web"]},{"url":"https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64518","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6fhj-vr9j-g45r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64518.json","tags":["advisory"]},{"url":"https://github.com/CycloneDX/cyclonedx-core-java","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-64518","title":"CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection","description":"The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.","status":"published","published":"2025-11-10T22:08:06.229Z","modified":"2025-11-12T20:13:21.105Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:32:46.750177Z"}],"euvd":[{"id":"EUVD-2025-50813","description":"The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.","status":"published","published":"2025-11-10T22:08:06Z","modified":"2025-11-12T20:13:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:18.397537Z"}],"ghsa":[{"id":"GHSA-6fhj-vr9j-g45r","title":"CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection ","description":"### Impact\n\nThe XML [`Validator`](https://docs.oracle.com/javase/8/docs/api/javax/xml/validation/Validator.html) used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection.\n\nThe fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed *parsing* of XML BOMs, but not *validation*.\n\n### Patches\n\nThe vulnerability has been fixed in cyclonedx-core-java version 11.0.1.\n\n### Workarounds\n\nIf feasible, applications can reject XML documents before handing them to cyclonedx-core-java for validation.\nThis may be an option if incoming CycloneDX BOMs are known to be in JSON format.\n\n### References\n\n* The issue was introduced via https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9\n* The issue was fixed via https://github.com/CycloneDX/cyclonedx-core-java/pull/737\n* https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory","status":"published","published":"2025-11-10T21:04:03Z","modified":"2025-11-15T02:46:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:39:08.983925Z"}],"nvd":[{"id":"CVE-2025-64518","description":"The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.","status":"published","published":"2025-11-10T22:15:40.497Z","modified":"2026-06-17T09:54:31.417Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:11:42.870953Z"}],"osv":[{"id":"CVE-2025-64518","title":"CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection","description":"The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.","status":"published","published":"2025-11-10T22:08:06.229Z","modified":"2026-10-28T11:00:34.96352816Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:44:51.851511Z"},{"id":"GHSA-6fhj-vr9j-g45r","title":"CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection ","description":"### Impact\n\nThe XML [`Validator`](https://docs.oracle.com/javase/8/docs/api/javax/xml/validation/Validator.html) used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection.\n\nThe fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed *parsing* of XML BOMs, but not *validation*.\n\n### Patches\n\nThe vulnerability has been fixed in cyclonedx-core-java version 11.0.1.\n\n### Workarounds\n\nIf feasible, applications can reject XML documents before handing them to cyclonedx-core-java for validation.\nThis may be an option if incoming CycloneDX BOMs are known to be in JSON format.\n\n### References\n\n* The issue was introduced via https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9\n* The issue was fixed via https://github.com/CycloneDX/cyclonedx-core-java/pull/737\n* https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory","status":"published","published":"2025-11-10T21:04:03Z","modified":"2026-09-10T03:50:30.71876377Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:39.618611Z"}]}}