GitHub Advisoryadvisory · Maven

GHSA-6fhj-vr9j-g45r CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

HIGH Published 2025-11-10 Modified 2025-11-15 Official page ↗

Aliases: CVE-2025-64518
Ecosystem: Maven
Packages: org.cyclonedx:cyclonedx-core-java
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-611
Reviewed: 2025-11-10

Affected packages

• Maven org.cyclonedx:cyclonedx-core-java: >= 2.1.0, < 11.0.1 → fixed in 11.0.1

Description

Impact The XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed *parsing* of XML BOMs, but not *validation*. Patches The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. Workarounds If feasible, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format. References • The issue was introduced via https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9 • The issue was fixed via https://github.com/CycloneDX/cyclonedx-core-java/pull/737 • https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory

Related

Alias · CVE (1)

CVE-2025-64518 The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing… vulnerability

Weakness · CWE (1)

CWE-611 Improper Restriction of XML External Entity Reference weakness

References