by Kastro
Paper/Archive/CVE-2026-61741

CVE-2026-61741

http4s http4s-scala-xml — http4s-scala-xml has an XML External Entity (XXE) processing issue

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
32
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 22.1.221 × 204.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a `javax.xml.parsers.SAXParserFactory` obtained from `SAXParserFactory.newInstance` without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks. An attacker can craft a request that discloses local files readable by the service process, performs server-side request forgery (SSRF) against internal network resources, and/or causes denial of service through entity expansion. Versions 0.24.1 and 1.0.0-M39 fix the issue.

Affected

ProductAffectedFixed inSource
http4s-scala-xml< 0.24.1–CNA
http4s-scala-xml>= 1.0.0-M1, < 1.0.0-M39–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7