CVE-2025-64518

The record

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.

Affected packages

Related vulnerabilities

• CVE-2025-67030 Directory Traversal vulnerability in the extractFile method of… Also affects dependency-track
• CVE-2026-1605 In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a… Also affects dependency-track
• CVE-2025-11143 The Jetty URI parser has some key differences to other common parsers when evaluating… Also affects dependency-track
• CVE-2026-1225 ACE vulnerability in configuration file processing by QOS.CH logback-core up to and… Also affects dependency-track
• CVE-2025-11226 ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up… Also affects dependency-track
• CVE-2025-48924 Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs Also affects dependency-track
• CVE-2024-57699 A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. Also affects dependency-track
• CVE-2024-12801 Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to… Also affects dependency-track