http4s-scala-xml has an XML External Entity (XXE) processing issue
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a `javax.xml.parsers.SAXParserFactory` obtained from `SAXParserFactory.newInstance` without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks. An attacker can craft a request that discloses local files readable by the service process, performs server-side request forgery (SSRF) against internal network resources, and/or causes denial of service through entity expansion. Versions 0.24.1 and 1.0.0-M39 fix the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| http4s | http4s-scala-xml | before 0.24.1; 1.0.0-M1 to before 1.0.0-M39 | 0.24.1, 1.0.0-M39 | Patch available | CNA |
| — | org.http4s:http4s-scala-xml_2.12 (Maven) | before 0.24.1 | 0.24.1 | Patch available | GHSA-cjx3-73hr-rpw7 |
| — | org.http4s:http4s-scala-xml_2.13 (Maven) | before 0.24.1 | 0.24.1 | Patch available | GHSA-cjx3-73hr-rpw7 |
| — | org.http4s:http4s-scala-xml_2.13 (Maven) | 1.0.0-M1 to before 1.0.0-M39 | 1.0.0-M39 | Patch available | GHSA-cjx3-73hr-rpw7 |
| — | org.http4s:http4s-scala-xml_3 (Maven) | before 0.24.1 | 0.24.1 | Patch available | GHSA-cjx3-73hr-rpw7 |
| — | org.http4s:http4s-scala-xml_3 (Maven) | 1.0.0-M1 to before 1.0.0-M39 | 1.0.0-M39 | Patch available | GHSA-cjx3-73hr-rpw7 |
- http4s-scala-xml Vendorhttp4s Affected before 0.24.1; 1.0.0-M1 to before 1.0.0-M39 Fixed in 0.24.1, 1.0.0-M39 Patch available CNA
- org.http4s:http4s-scala-xml_2.12 (Maven) Vendor— Affected before 0.24.1 Fixed in 0.24.1 Patch available GHSA-cjx3-73hr-rpw7
- org.http4s:http4s-scala-xml_2.13 (Maven) Vendor— Affected before 0.24.1 Fixed in 0.24.1 Patch available GHSA-cjx3-73hr-rpw7
- org.http4s:http4s-scala-xml_2.13 (Maven) Vendor— Affected 1.0.0-M1 to before 1.0.0-M39 Fixed in 1.0.0-M39 Patch available GHSA-cjx3-73hr-rpw7
- org.http4s:http4s-scala-xml_3 (Maven) Vendor— Affected before 0.24.1 Fixed in 0.24.1 Patch available GHSA-cjx3-73hr-rpw7
- org.http4s:http4s-scala-xml_3 (Maven) Vendor— Affected 1.0.0-M1 to before 1.0.0-M39 Fixed in 1.0.0-M39 Patch available GHSA-cjx3-73hr-rpw7
Remediation
- Fix · CNA http4s-scala-xml (http4s) Fixed in 0.24.1, 1.0.0-M39
- Fix · GHSA-cjx3-73hr-rpw7 org.http4s:http4s-scala-xml_2.12 (Maven) Fixed in 0.24.1 Advisory →
- Fix · GHSA-cjx3-73hr-rpw7 org.http4s:http4s-scala-xml_2.13 (Maven) Fixed in 0.24.1 Advisory →
- Fix · GHSA-cjx3-73hr-rpw7 org.http4s:http4s-scala-xml_2.13 (Maven) Fixed in 1.0.0-M39 Advisory →
- Fix · GHSA-cjx3-73hr-rpw7 org.http4s:http4s-scala-xml_3 (Maven) Fixed in 0.24.1 Advisory →
- Fix · GHSA-cjx3-73hr-rpw7 org.http4s:http4s-scala-xml_3 (Maven) Fixed in 1.0.0-M39 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-61741
- 2026-10-03 Alias added: GHSA-cjx3-73hr-rpw7
References
Other 5
- https://github.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7
- https://github.com/http4s/http4s-scala-xml/commit/326f965a2c45fc2ddbc22545dcf551b0f719f4c8
- https://github.com/http4s/http4s-scala-xml
- https://github.com/http4s/http4s-scala-xml/releases/tag/v0.24.1
- https://github.com/http4s/http4s-scala-xml/releases/tag/v1.0.0-M39
More http4s vulnerabilities
- TI-2022-13223 mTLS client verification is skipped in fs2 on Node.js CVSS 3.1CRITICAL 9.8
- TI-2023-08714 Http4s has fatal error parsing User-Agent and Server headers CVSS 3.1HIGH 7.5
- TI-2022-06031 Hash collision in typelevel jawn CVSS 3.1HIGH 7.5
- TI-2025-37261 Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section CVSS 4.0MEDIUM 6.3
- TI-2020-04336 Local file inclusion vulnerability in http4s CVSS 3.1HIGH 7.6
- TI-2026-48548 Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) CVSS 4.0CRITICAL 9.2
Sources
- CVE-2026-61741 · CVE Program
- CVE-2026-61741 · NVD
- FIRST EPSS
- GHSA-cjx3-73hr-rpw7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences