CVE-2026-61741GHSA-cjx3-73hr-rpw7
org.http4s:http4s-scala-xml_2.12: http4s-scala-xml has an XML External Entity (XXE) processing issue
http4s org.http4s:http4s-scala-xml_2.12mavenLibraries & packages
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.24.1org.http4s:http4s-scala-xml_2.12, mavenGitHub
<dependency><groupId>org.http4s</groupId><artifactId>http4s-scala-xml_2.12</artifactId><version>0.24.1</version></dependency> - 0.24.1org.http4s:http4s-scala-xml_2.13, mavenGitHub
<dependency><groupId>org.http4s</groupId><artifactId>http4s-scala-xml_2.13</artifactId><version>0.24.1</version></dependency> - 1.0.0-M39org.http4s:http4s-scala-xml_2.13, mavenGitHub
<dependency><groupId>org.http4s</groupId><artifactId>http4s-scala-xml_2.13</artifactId><version>1.0.0-M39</version></dependency> - 0.24.1org.http4s:http4s-scala-xml_3, mavenGitHub
<dependency><groupId>org.http4s</groupId><artifactId>http4s-scala-xml_3</artifactId><version>0.24.1</version></dependency> - 1.0.0-M39org.http4s:http4s-scala-xml_3, mavenGitHub
<dependency><groupId>org.http4s</groupId><artifactId>http4s-scala-xml_3</artifactId><version>1.0.0-M39</version></dependency> - 0.24.1org.http4s:http4s-scala-xml_2.12, MavenOSV
<dependency><groupId>org.http4s</groupId><artifactId>http4s-scala-xml_2.12</artifactId><version>0.24.1</version></dependency>
Show all 10 fixed versions
- 0.24.1org.http4s:http4s-scala-xml_2.13, MavenOSV
<dependency><groupId>org.http4s</groupId><artifactId>http4s-scala-xml_2.13</artifactId><version>0.24.1</version></dependency> - 1.0.0-M39org.http4s:http4s-scala-xml_2.13, MavenOSV
<dependency><groupId>org.http4s</groupId><artifactId>http4s-scala-xml_2.13</artifactId><version>1.0.0-M39</version></dependency> - 0.24.1org.http4s:http4s-scala-xml_3, MavenOSV
<dependency><groupId>org.http4s</groupId><artifactId>http4s-scala-xml_3</artifactId><version>0.24.1</version></dependency> - 1.0.0-M39org.http4s:http4s-scala-xml_3, MavenOSV
<dependency><groupId>org.http4s</groupId><artifactId>http4s-scala-xml_3</artifactId><version>1.0.0-M39</version></dependency>
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
http4s-scala-xml provides EntityDecoder[F, scala.xml.Elem] instances that parse XML message bodies. These decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.
An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks. An attacker can craft a request that:
- discloses local files readable by the service process,
- performs server-side request forgery (SSRF) against internal network resources, and/or
- causes denial of service through entity expansion.
Impact
Any service that derives an XML EntityDecoder from this library and parses attacker-controlled input is affected.
Patches
The default SAXParserFactory is now hardened:
- secure processing is enabled
DOCTYPEdeclarations are disallowed- external general/parameter entities and external DTD loading are disabled
- DTD URIs are not resolved
- XInclude is disabled.
These defaults match scala.xml.XMLLoader's defaults since 2.0.0.
Workarounds
Before upgrading, override ElemInstances#saxFactory with a hardened factory.
val secured = new ElemInstances {
override protected val saxFactory = {
val f = javax.xml.parsers.SAXParserFactory.newInstance
f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
// etc.
f
}
}
import secured._Text from GitHub Advisory Database
Affected versions 197
- org.http4s:http4s-scala-xml_2.12, maven<= 0.24.0GitHub
- org.http4s:http4s-scala-xml_2.13, maven<= 0.24.0GitHub
- org.http4s:http4s-scala-xml_2.13, maven>= 1.0.0-M1, <= 1.0.0-M38.1GitHub
- org.http4s:http4s-scala-xml_3, maven<= 0.24.0GitHub
- org.http4s:http4s-scala-xml_3, maven>= 1.0.0-M1, <= 1.0.0-M38.1GitHub
- http4s-scala-xmlaffected: < 0.24.1CVE List
- http4s-scala-xmlaffected: >= 1.0.0-M1, < 1.0.0-M39CVE List
- org.http4s:http4s-scala-xml_2.12, Mavenfrom first release, fixed in 0.24.1OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.10.0-M10OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.0OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.0aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.1OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.10OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.10aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.11OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.11aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.12OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.12aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.13OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.13aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.14OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.14aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.15OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.15aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.16OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.16aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.1aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.2OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.2aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.3OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.3aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.4OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.4aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.5OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.5aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.6OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.6aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.7OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.7aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.8OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.8aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.9OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.15.9aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.0OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.0-M1OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.0-M2OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.0-M3OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.0-RC1OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.0-RC2OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.0-RC3OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.0aOSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.0a-M1OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.0a-M2OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.0a-M3OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.0a-RC1OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.0a-RC2OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.0a-RC3OSV
- org.http4s:http4s-scala-xml_2.12, Maven0.16.1OSV
- org.http4s:http4s-scala-xml_2.13, Mavenfrom first release, fixed in 0.24.1OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.10.0-M10OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.0OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.0-M1OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.0-M2OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.0-M3OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.0-M4OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.0-M5OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.0-M6OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.0-RC1OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.0-RC2OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.0-RC3OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.0-RC4OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.0-RC5OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.1OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.11OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.12OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.13OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.14OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.15OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.16OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.17OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.18OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.19OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.2OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.20OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.21OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.22OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.23OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.24OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.25OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.26OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.27OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.28OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.29OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.3OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.30OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.31OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.32OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.33OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.34OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.4OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.5OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.6OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.7OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.8OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.21.9OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.22-129-24d065bOSV
- org.http4s:http4s-scala-xml_2.13, Maven0.22-143-49b5a8dOSV
- org.http4s:http4s-scala-xml_2.13, Maven0.22-53-01128f5OSV
- org.http4s:http4s-scala-xml_2.13, Maven0.22-96-55d3184OSV
- org.http4s:http4s-scala-xml_2.13, Mavenfrom 1.0.0-M1, fixed in 1.0.0-M39OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M10OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M13OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M14OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M15OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M16OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M17OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M18OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M19OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M2OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M20OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M21OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M22OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M23OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M24OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M25OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M27OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M28OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M29OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M3OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M30OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M31OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M32OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M33OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M34OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M35OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M38OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M38.1OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M4OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M5OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M6OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M7OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M8OSV
- org.http4s:http4s-scala-xml_2.13, Maven1.0.0-M9OSV
- org.http4s:http4s-scala-xml_3, Mavenfrom first release, fixed in 0.24.1OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.0OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.0-M8OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.0-RC1OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.1OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.10OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.11OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.12OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.13OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.14OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.15OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.2OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.3OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.4OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.5OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.6OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.7OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.8OSV
- org.http4s:http4s-scala-xml_3, Maven0.22.9OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.0OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.0-M1OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.0-RC1OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.1OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.10OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.11OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.12OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.13OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.14OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.15OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.2OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.3OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.4OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.5OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.6OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.7OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.8OSV
- org.http4s:http4s-scala-xml_3, Maven0.23.9OSV
- org.http4s:http4s-scala-xml_3, Maven0.24.0OSV
- org.http4s:http4s-scala-xml_3, Mavenfrom 1.0.0-M1, fixed in 1.0.0-M39OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M22OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M23OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M24OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M25OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M27OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M28OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M29OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M30OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M31OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M32OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M33OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M34OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M35OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M38OSV
- org.http4s:http4s-scala-xml_3, Maven1.0.0-M38.1OSV
References 6
- github.com/http4s/http4s-scala-xml/commit/326f965a2c45fc2ddbc22545dcf551b0f719f4c8Fixvia GitHub
- github.com/http4s/http4s-scala-xml/releases/tag/v0.24.1Fixvia GitHub
- github.com/http4s/http4s-scala-xml/releases/tag/v1.0.0-M39Fixvia GitHub
- github.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7Advisoryvia CVE List
- github.com/advisories/GHSA-cjx3-73hr-rpw7Advisoryvia GitHub
- nvd.nist.gov/vuln/detail/CVE-2026-61741Referencevia GitHub