7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64518

CVE-2025-64518: CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

Impact

The XML Validator used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection.

The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed parsing of XML BOMs, but not validation.

Patches

The vulnerability has been fixed in cyclonedx-core-java version 11.0.1.

Workarounds

If feasible, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.

References

The issue was introduced via https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9
The issue was fixed via https://github.com/CycloneDX/cyclonedx-core-java/pull/737
https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64518

CVE-2025-64518:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.cyclonedx:cyclonedx-core-java	maven	>= 2.1.0, < 11.0.1	11.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an XML External Entity (XXE) injection flaw within the XML validation functionality of the cyclonedx-core-java library. The root cause is the insecure configuration of javax.xml.validation.SchemaFactory in the org.cyclonedx.CycloneDxSchema.getXmlSchema method. This method failed to disable the processing of external XML entities, which is a requirement for preventing XXE attacks.

The fixing commit, af0ec75c93c03f93733a070c5132554490af5314, directly patches the getXmlSchema method by setting the ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_SCHEMA properties to empty strings and enabling the FEATURE_SECURE_PROCESSING feature. This prevents the XML parser from resolving external entities during schema validation.

The vulnerable getXmlSchema method is called by the public validate methods in the org.cyclonedx.parsers.XmlParser class. These validate methods are the primary user-facing entry points for triggering the vulnerability. An attacker would supply a malicious XML document to one of these methods, which would then use the insecurely generated schema, leading to the XXE injection. The patch confirms this by adding a test case, validateShouldNotBeVulnerableToXxe, which attempts to validate a malicious XML file and asserts that the external entity processing is correctly denied.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-64518: CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

Impact

Patches

Workarounds

References

CVE-2025-64518:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

7.5

7.5

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

CVE-2025-64518: CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

Impact

Patches

Workarounds

References

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI