PT-2025-46213 · Unknown · Cyclonedx-Core-Java

Published 2025-11-10 · Updated 2025-11-13 · CVE-2025-64518

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CycloneDX versions 2.1.0 through 11.0.1

Description The CycloneDX core module, used for creating, validating, and parsing SBOMs, contains a flaw due to an insecurely configured XML Validator. This allows for XML External Entity (XXE) injection. The initial fix for a related issue only addressed XML parsing, not validation. The Validator component is susceptible to exploitation.

Recommendations CycloneDX versions 2.1.0 through 11.0.0 should be updated to version 11.0.1. As a workaround, applications can reject XML documents before passing them to CycloneDX for validation. If incoming CycloneDX BOMs are known to be in JSON format, applications can reject XML documents.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-64518

GHSA-6FHJ-VR9J-G45R

Affected Products

Cyclonedx-Core-Java

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64518.json · Exploit
• https://osv.dev/vulnerability/GHSA-6fhj-vr9j-g45r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64518 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64518 · Security Note
• https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-6fhj-vr9j-g45r · Note
• https://github.com/CycloneDX/cyclonedx-core-java/commit/af0ec75c93c03f93733a070c5132554490af5314 · Note
• https://github.com/CycloneDX/cyclonedx-core-java/pull/737 · Note
• https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9 · Note
• https://github.com/CycloneDX/cyclonedx-core-java · Note
• https://twitter.com/CVEnew/status/1988012787377823956 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ouaay3/resumen_diario_de_vulnerabilidades_11112025 · Reddit Post
• https://twitter.com/gN3mes1s/status/1988228632116883535 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ov498g/resumen_diario_de_vulnerabilidades_12112025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1988137395892457688 · Twitter Post
• https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory · Note