CVE-2025-64518

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64518", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-11-05T21:15:39.400Z", "datePublished": "2025-11-10T22:08:06.229Z", "dateUpdated": "2025-11-12T20:13:21.105Z"}, "containers": {"cna": {"title": "CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "lang": "en", "description": "CWE-611: Improper Restriction of XML External Entity Reference", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-6fhj-vr9j-g45r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-6fhj-vr9j-g45r"}, {"name": "https://github.com/CycloneDX/cyclonedx-core-java/pull/737", "tags": ["x_refsource_MISC"], "url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/737"}, {"name": "https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9", "tags": ["x_refsource_MISC"], "url": "https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9"}, {"name": "https://github.com/CycloneDX/cyclonedx-core-java/commit/af0ec75c93c03f93733a070c5132554490af5314", "tags": ["x_refsource_MISC"], "url": "https://github.com/CycloneDX/cyclonedx-core-java/commit/af0ec75c93c03f93733a070c5132554490af5314"}, {"name": "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory", "tags": ["x_refsource_MISC"], "url": "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory"}], "affected": [{"vendor": "CycloneDX", "product": "cyclonedx-core-java", "versions": [{"version": ">= 2.1.0, <11.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-10T22:08:06.229Z"}, "descriptions": [{"lang": "en", "value": "The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format."}], "source": {"advisory": "GHSA-6fhj-vr9j-g45r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-12T17:34:30.246493Z", "id": "CVE-2025-64518", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T20:13:21.105Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-64518", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T17:34:30.246493Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T17:34:32.367Z"}}], "cna": {"title": "CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection", "source": {"advisory": "GHSA-6fhj-vr9j-g45r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "CycloneDX", "product": "cyclonedx-core-java", "versions": [{"status": "affected", "version": ">= 2.1.0, <11.0.1"}]}], "references": [{"url": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-6fhj-vr9j-g45r", "name": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-6fhj-vr9j-g45r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/737", "name": "https://github.com/CycloneDX/cyclonedx-core-java/pull/737", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9", "name": "https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/CycloneDX/cyclonedx-core-java/commit/af0ec75c93c03f93733a070c5132554490af5314", "name": "https://github.com/CycloneDX/cyclonedx-core-java/commit/af0ec75c93c03f93733a070c5132554490af5314", "tags": ["x_refsource_MISC"]}, {"url": "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory", "name": "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "CWE-611: Improper Restriction of XML External Entity Reference"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-10T22:08:06.229Z"}}}, "cveMetadata": {"cveId": "CVE-2025-64518", "state": "PUBLISHED", "dateUpdated": "2025-11-12T20:13:21.105Z", "dateReserved": "2025-11-05T21:15:39.400Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-11-10T22:08:06.229Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cyclonedx-core-java", "vendor": "CycloneDX", "versions": [{"status": "affected", "version": ">= 2.1.0, <11.0.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format."}, {"lang": "es", "value": "El m\u00f3dulo central de CycloneDX proporciona una representaci\u00f3n de modelo del SBOM junto con utilidades para ayudar en la creaci\u00f3n, validaci\u00f3n y an\u00e1lisis de SBOMs. A partir de la versi\u00f3n 2.1.0 y antes de la versi\u00f3n 11.0.1, el 'Validator' XML utilizado por cyclonedx-core-java no estaba configurado de forma segura, haciendo que la librer\u00eda fuera vulnerable a la inyecci\u00f3n de entidad externa XML (XXE). La correcci\u00f3n para GHSA-683x-4444-jxh8 / CVE-2024-38374 fue incompleta ya que solo corrigi\u00f3 el an\u00e1lisis de los BOMs XML, pero no la validaci\u00f3n. La vulnerabilidad ha sido corregida en la versi\u00f3n 11.0.1 de cyclonedx-core-java. Como soluci\u00f3n alternativa, las aplicaciones pueden rechazar documentos XML antes de entregarlos a cyclonedx-core-java para su validaci\u00f3n. Esto puede ser una opci\u00f3n si se sabe que los BOMs CycloneDX entrantes est\u00e1n en formato JSON."}], "id": "CVE-2025-64518", "lastModified": "2026-06-17T09:54:31.417", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64518", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-12T17:34:30.246493Z", "version": "2.0.3"}}]}, "published": "2025-11-10T22:15:40.497", "references": [{"source": "security-advisories@github.com", "url": "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory"}, {"source": "security-advisories@github.com", "url": "https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9"}, {"source": "security-advisories@github.com", "url": "https://github.com/CycloneDX/cyclonedx-core-java/commit/af0ec75c93c03f93733a070c5132554490af5314"}, {"source": "security-advisories@github.com", "url": "https://github.com/CycloneDX/cyclonedx-core-java/pull/737"}, {"source": "security-advisories@github.com", "url": "https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-6fhj-vr9j-g45r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "cyclonedx-core-java: CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection", "id": "2413922", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413922"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-611", "details": ["The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.", "An XML External Entity (XXE) injection vulnerability was found in the CycloneDX Java core library\u2019s XML validation step where the XML Validator was not configured securely. When a specially crafted CycloneDX BOM (XML) is validated, external XML entities can be processed (XXE), allowing an attacker to cause the application to disclose local files or make requests to internal network resources. This can occur when untrusted BOM XML is parsed or validated by the library."], "mitigation": {"lang": "en:us", "value": "Reject or block XML-formatted BOMs from untrusted sources before handing them to the library (e.g., require BOMs to be JSON or only accept BOMs from trusted origins)."}, "name": "CVE-2025-64518", "package_state": [{"cpe": "cpe:/a:redhat:amq_clients:2023", "fix_state": "Affected", "package_name": "cyclonedx-core-java", "product_name": "AMQ Clients"}, {"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Affected", "package_name": "cyclonedx-core-java", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}, {"cpe": "cpe:/a:redhat:service_registry:2", "fix_state": "Affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat build of Apicurio Registry 2"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "cyclonedx-core-java", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Affected", "package_name": "cyclonedx-core-java", "product_name": "streams for Apache Kafka 2"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Affected", "package_name": "cyclonedx-core-java", "product_name": "streams for Apache Kafka 3"}], "public_date": "2025-11-10T22:08:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-64518\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-64518\nhttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory\nhttps://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9\nhttps://github.com/CycloneDX/cyclonedx-core-java/commit/af0ec75c93c03f93733a070c5132554490af5314\nhttps://github.com/CycloneDX/cyclonedx-core-java/pull/737\nhttps://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-6fhj-vr9j-g45r"], "statement": "The flaw has been rated High severity, because a remote attacker could craft a malicious CycloneDX SBOM that, when validated by an affected system, may result in disclosure of sensitive information from local files or internal network resources. Exploitation does not require authentication or user interaction, but it depends on the application accepting and processing untrusted CycloneDX XML input, the environments that automatically ingest SBOMs from external or untrusted sources.\n~~~\nThis issue was introduced in cyclonedx-core-java v2.1.0 via commit https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9.\nThis vulnerability is related to, but distinct from, the previously fixed CVE-2024-38374, which addressed a similar XML External Entity (XXE) flaw in the SBOM parsing logic. That earlier fix secured the XML parser but did not cover the separate validation process, leaving this secondary XXE path unprotected. This new CVE closes that remaining gap by securing the XML validator used during schema validation.\n~~~", "threat_severity": "Important"}

{"created": "2025-11-12T12:48:14.098965+00:00", "updated": "2025-11-12T12:48:14.099001+00:00", "vendors": ["cyclonedx", "cyclonedx$PRODUCT$cyclonedx_core_java"]}