What’s Vulnerable › Vulnerabilities

CVE-2024-38374: Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-28 · updated 2026-06-17
• Weakness: CWE-611

Description

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverages XPath expressions to determine the schema version of the BOM. The `DocumentBuilderFactory` used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. This vulnerability has been fixed in cyclonedx-core-java version 9.0.4.

Affected products

• Cyclonedx Core Java: from 2.1.0 before 9.0.4 — fixed in 9.0.4

How to fix

Upgrade to a fixed version: Cyclonedx Core Java 9.0.4. Check the vendor advisory for mitigations.

References

• https://github.com/CycloneDX/cyclonedx-core-java/pull/434
• https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d
• https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8
• https://github.com/CycloneDX/cyclonedx-core-java/pull/434
• https://github.com/CycloneDX/cyclonedx-core-java/pull/434/commits/ab0bc9c530d24f737970dbd0287d1190b129853d
• https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8

Get alerted when CVE-2024-38374 or the next vulnerability affects your stack