← Back to the live CVE advisory feed

CVE-2026-61741: http4s-scala-xml

Severity

9.3 (CRITICAL)

Vendor

HTTP4S

Affected versions

< 0.24.1; >= 1.0.0-M1, < 1.0.0-M39

Patch status

Unknown

Published

2026-09-24T18:17:16.013

Modified

2026-09-24T18:17:16.013

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a `javax.xml.parsers.SAXParserFactory` obtained from `SAXParserFactory.newInstance` without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks. An attacker can craft a request that discloses local files readable by the service process, performs server-side request forgery (SSRF) against internal network resources, and/or causes denial of service through entity expansion. Versions 0.24.1 and 1.0.0-M39 fix the issue.

View the official NVD record for CVE-2026-61741

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.