{"cve":"CVE-2026-61741","nvd":{"published":"2026-09-24T18:17:16.013","modified":"2026-09-30T19:57:08.043","status":"Deferred","description":"http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a `javax.xml.parsers.SAXParserFactory` obtained from `SAXParserFactory.newInstance` without any security configuration.  With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks.  An attacker can craft a request that discloses local files readable by the service process, performs server-side request forgery (SSRF) against internal network resources, and/or causes denial of service through entity expansion. Versions 0.24.1 and 1.0.0-M39 fix the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","score":9.3},"cwes":["CWE-611"],"references":["https://github.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-61741","score":0.00294,"percentile":0.21833,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-cjx3-73hr-rpw7","url":"https://osv.dev/vulnerability/GHSA-cjx3-73hr-rpw7","summary":"http4s-scala-xml has an XML External Entity (XXE) processing issue","modified":"2026-09-24T19:45:05.160315055Z","packages":[{"ecosystem":"Maven","name":"org.http4s:http4s-scala-xml_2.12","purl":"pkg:maven/org.http4s/http4s-scala-xml_2.12","ranges":["<0.24.1"],"fixed":["0.24.1"]},{"ecosystem":"Maven","name":"org.http4s:http4s-scala-xml_2.13","purl":"pkg:maven/org.http4s/http4s-scala-xml_2.13","ranges":["<0.24.1"],"fixed":["0.24.1"]},{"ecosystem":"Maven","name":"org.http4s:http4s-scala-xml_2.13","purl":"pkg:maven/org.http4s/http4s-scala-xml_2.13","ranges":[">=1.0.0-M1 <1.0.0-M39"],"fixed":["1.0.0-M39"]},{"ecosystem":"Maven","name":"org.http4s:http4s-scala-xml_3","purl":"pkg:maven/org.http4s/http4s-scala-xml_3","ranges":["<0.24.1"],"fixed":["0.24.1"]},{"ecosystem":"Maven","name":"org.http4s:http4s-scala-xml_3","purl":"pkg:maven/org.http4s/http4s-scala-xml_3","ranges":[">=1.0.0-M1 <1.0.0-M39"],"fixed":["1.0.0-M39"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}