CVE-2026-61741

Deferred Deferred - Pending Action

XML External Entity Injection in http4s-scala-xml

Publication date: 2026-09-24

Last updated on: 2026-09-29

Assigner: GitHub, Inc.

Description

http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a `javax.xml.parsers.SAXParserFactory` obtained from `SAXParserFactory.newInstance` without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks. An attacker can craft a request that discloses local files readable by the service process, performs server-side request forgery (SSRF) against internal network resources, and/or causes denial of service through entity expansion. Versions 0.24.1 and 1.0.0-M39 fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-29

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-61741

EUVD

EUVD-2026-86332

Affected Vendors & Products

Vendor	Product	Version / Range
http4s	http4s-scala-xml	to 0.24.1 (exc)
http4s	http4s-scala-xml	to 1.0.0-M39 (exc)
http4s	http4s-scala-xml	0.24.1
http4s	http4s-scala-xml	1.0.0-M39

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

This vulnerability is an XML External Entity (XXE) attack in the http4s-scala-xml library. It occurs because the library's XML parsers use default settings that allow processing of DOCTYPE declarations and external entities. This enables attackers to craft malicious XML requests that can read local files, perform SSRF attacks, or cause denial of service through entity expansion.

Detection Guidance

To detect this vulnerability, check if your system uses http4s-scala-xml versions prior to 0.24.1 or 1.0.0-M39. Run commands like 'find / -name "*.jar" -exec grep -l "http4s-scala-xml" {} \;' to locate the library. Verify the version in your project dependencies or dependency tree output.

Impact Analysis

If you use affected versions of http4s-scala-xml to parse untrusted XML, an attacker could exploit this to access sensitive files on your server, make unauthorized requests to internal systems, or crash your application through excessive resource consumption.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations processing sensitive data must address XXE risks to maintain compliance.

Mitigation Strategies

Immediately upgrade http4s-scala-xml to version 0.24.1 or 1.0.0-M39 or later. If upgrading is not possible, disable DOCTYPE processing and external entity resolution in your XML parser configuration. Review and restrict network access to prevent SSRF attacks.

Hi! I’m here to help you understand CVE-2026-61741. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70