CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection
Published Nov 10, 2025 · Updated Oct 23, 2026 · Also known as GHSA-6fhj-vr9j-g45r
Original summary
Normalized public record · Updated Oct 23, 2026
CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
The XML [`Validator`](https://docs.oracle.com/javase/8/docs/api/javax/xml/validation/Validator.html) used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection.
Potential impact
The XML Validator used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed parsing of XML BOMs, but not validation.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- MEDIUM
- Confidence
- 10%
- Aliases
- GHSA-6fhj-vr9j-g45r
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
- Security advisory ↗
- Source repository ↗
- Patch commit ↗
- Patch commit ↗
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory ↗
Record history
Published Nov 10, 2025 · Last refreshed Oct 23, 2026