CVE-2026-61741: http4s-scala-xml XML External Entity (XXE) Processing Vulnerability
Summary
CVE-2026-61741: http4s-scala-xml has an XML External Entity (XXE) processing issue. Affects org.http4s:http4s-scala-xml_2.12 versions < 0.24.1. Fixed in 0.24.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
http4s-scala-xml is a library that provides EntityDecoder[F, scala.xml.Elem] instances for parsing XML message bodies in Scala applications. It is widely used for handling XML data in HTTP requests. However, the library has a critical vulnerability that allows for XML External Entity (XXE) attacks due to improper security configurations in its XML parsing mechanisms.
Vulnerability Detail
The vulnerability arises from the use of javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configurations. This allows the parser to resolve DOCTYPE declarations, external entities, and DTDs, making it susceptible to XXE attacks. An attacker can exploit this vulnerability to disclose local files, perform server-side request forgery (SSRF), or cause denial of service through entity expansion. The default settings of the JDK do not provide adequate protection against these threats.
How To Fix
Latest published version: 1.0-57-0368053 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.24.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade immediately, you can override the ElemInstances#saxFactory with a hardened factory. Here is an example of how to implement this in your Scala code:
val secured = new ElemInstances {
override protected val saxFactory = {
val f = javax.xml.parsers.SAXParserFactory.newInstance
f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
f.setFeature("http://xml.org/sax/features/external-general-entities", false)
f.setFeature("http://xml.org/sax/features/external-parameter-entities", false)
f.setFeature("http://apache.org/xml/features/xinclude", false)
f
}
}
import secured._
Conclusion
The http4s-scala-xml library has a critical vulnerability related to XML External Entity (XXE) processing. It is essential to update to the patched version or implement a workaround to mitigate the risks associated with this vulnerability. Regular monitoring using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for org.http4s:http4s-scala-xml_2.12 →
FAQ
An XXE attack occurs when an XML parser processes external entities, allowing attackers to access sensitive data or perform actions on behalf of the server.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time based on your pom.xml.
The impacts include unauthorized access to local files, server-side request forgery (SSRF), and denial of service through entity expansion.
Yes, the vulnerability is patched in version 0.24.1 and later of the http4s-scala-xml package.
You can implement a workaround by overriding the SAXParserFactory with a hardened configuration as shown in the provided code example.
