CVE-2025-64518

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.

• CWE-611

• https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory
• https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9
• https://github.com/CycloneDX/cyclonedx-core-java/commit/af0ec75c93c03f93733a070c5132554490af5314
• https://github.com/CycloneDX/cyclonedx-core-java/pull/737
• https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-6fhj-vr9j-g45r

Published

Nov 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64511MaxKB is an open-source AI assistant for enterprise. In vers…8.8
• CVE-2025-64512Pdfminer.six is a community maintained fork of the original …7.8
• CVE-2025-64513Milvus is an open-source vector database built for generativ…9.3
• CVE-2025-64515Open Forms allows users create and publish smart forms. Prio…4.3
• CVE-2025-64516GLPI is a free asset and IT management software package. Pri…7.5
• CVE-2025-64517sudo-rs is a memory safe implementation of sudo and su writt…4.4
• CVE-2025-64519TorrentPier is an open source BitTorrent Public/Private trac…8.8
• CVE-2025-6452A vulnerability was found in CodeAstro Patient Record Manage…4.8
• CVE-2025-64520GLPI is a free asset and IT management software package. Sta…4.3
• CVE-2025-64521authentik is an open-source Identity Provider. Prior to vers…4.8
• CVE-2025-64522Soft Serve is a self-hostable Git server for the command lin…7.6
• CVE-2025-64523File Browser provides a file managing interface within a spe…8.8