DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61741: CVE-2026-61741: XML External Entity (XXE) Injection in http4s-scala-xml

#security #cve #cybersecurity

CVE-2026-61741: XML External Entity (XXE) Injection in http4s-scala-xml

Vulnerability ID: CVE-2026-61741
CVSS Score: 9.3
Published: 2026-09-24

CVE-2026-61741 is a critical XML External Entity (XXE) injection vulnerability in the http4s-scala-xml library. The vulnerability allows remote, unauthenticated attackers to perform arbitrary local file disclosure, execute server-side request forgery (SSRF) attacks, or cause denial of service via recursive entity expansion. The vulnerability stems from the use of an unconfigured SAXParserFactory, which enables external entity resolution by default.

TL;DR

An unauthenticated remote code-execution and disclosure vulnerability (XXE) exists in http4s-scala-xml due to an unhardened SAXParserFactory. Attackers can exploit this to read local host files, target internal networks via SSRF, or trigger denial of service via CPU/memory exhaustion.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-611
  • Attack Vector: Network
  • CVSS v3.1 Score: 9.3
  • Impact: Confidentiality: High, Availability: Low, Integrity: None
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • http4s-scala-xml library configurations running within scala-based JVM environments
  • http4s-scala-xml: < 0.24.1 (Fixed in: 0.24.1)
  • http4s-scala-xml: >= 1.0.0-M1, < 1.0.0-M39 (Fixed in: 1.0.0-M39)

Code Analysis

Commit: 326f965

Harden default SAX parser factory configurations in scalaxml package object.

Mitigation Strategies

  • Upgrade http4s-scala-xml to 0.24.1 or 1.0.0-M39 immediately.
  • Disable parsing of inline DOCTYPE declarations in any custom SAXParserFactory instances.
  • Deploy WAF rules to detect and reject HTTP POST/PUT requests containing XML DTD definitions.

Remediation Steps:

  1. Open the project's dependency definition file (e.g., build.sbt).
  2. Locate the library dependency reference for 'org.http4s' %% 'http4s-scala-xml'.
  3. Update the version string to '0.24.1' or '1.0.0-M39' depending on the active release train.
  4. Reload the project configuration and execute a clean build to enforce dependency resolution.
  5. Run automated security scanning tools to verify that vulnerable instances have been evicted.

References

Read the full report for CVE-2026-61741 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)