CVE-2025-64518: Cyclonedx Cyclonedx-Core-Java

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.

Affected products

• Cyclonedx Cyclonedx-Core-Java: from 2.1.0, before 11.0.1 (fixed in 11.0.1)

Published 2025-11-10. Last modified 2026-06-17.