Log in Start free

Vulnerability · Published Nov 10, 2025 · Assigned by GitHub_M

CVE-2025-64518CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

High 7.5

In plain English

A high-severity XML external entity in cyclonedx-core-java from CycloneDX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 66.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.cyclonedx:cyclonedx-core-java11.0.1GHSA-6fhj-vr9j-g45r

Affected products (as reported)

VendorProductVersions
CycloneDX cyclonedx-core-java >= 2.1.0, <11.0.1

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References