CVE-2026-61741: http4s-scala-xml XXE Vulnerability

CVE-2026-61741 Overview

CVE-2026-61741 is an XML External Entity (XXE) vulnerability [CWE-611] in the http4s-scala-xml library. The affected EntityDecoder[F, scala.xml.Elem] instances parse XML message bodies using a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security hardening. Under the JDK's default configuration, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs. Applications parsing untrusted XML with these decoders can be exploited to disclose local files, perform server-side request forgery (SSRF) against internal network resources, or trigger denial of service through entity expansion. The maintainers resolved the issue in versions 0.24.1 and 1.0.0-M39.

Critical Impact
An unauthenticated remote attacker can submit crafted XML to disclose local files, pivot to internal services via SSRF, or exhaust server resources through entity expansion.

Affected Products

http4s-scala-xml versions prior to 0.24.1 (0.24.x branch)
http4s-scala-xml versions prior to 1.0.0-M39 (1.0 milestone branch)
Any Scala/http4s application exposing an EntityDecoder[F, scala.xml.Elem] to untrusted XML input

Discovery Timeline

2026-09-24 - CVE-2026-61741 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-61741

Vulnerability Analysis

The http4s-scala-xml module provides decoders that convert HTTP request bodies into scala.xml.Elem values. These decoders obtain a SAX parser via SAXParserFactory.newInstance() and use it without disabling external entity resolution or DTD processing. The JDK defaults leave DOCTYPE parsing, external general entities, parameter entities, and external DTDs enabled. When an application wires one of these decoders to an endpoint that accepts XML from untrusted clients, the parser dutifully resolves attacker-supplied references during request handling.

The decoder behavior is consistent with the long-standing XXE anti-pattern documented in [CWE-611]. Because entity resolution happens inside the request pipeline, successful exploitation does not require authentication, user interaction, or special privileges on the target application.

Root Cause

The root cause is missing hardening on the SAX parser factory. The library did not call setFeature to disable DTD loading (http://apache.org/xml/features/disallow-doctype-decl), external general entities (http://xml.org/sax/features/external-general-entities), or external parameter entities (http://xml.org/sax/features/external-parameter-entities). It also did not set XMLConstants.FEATURE_SECURE_PROCESSING. Without these controls, the default parser follows every entity reference the attacker provides.

Attack Vector

An attacker sends an HTTP request whose body contains an XML document with a malicious DOCTYPE. The payload can define an external entity pointing to a local file path (for example, a sensitive configuration file readable by the service process) and reference that entity in the XML body to exfiltrate its contents in the response or in error messages. The same primitive supports SSRF by pointing the external entity at an internal URL, and billion-laughs-style denial of service through recursive entity expansion. Exploitation requires only that the vulnerable endpoint parse the submitted XML with one of the affected decoders.

See the GitHub Security Advisory GHSA-cjx3-73hr-rpw7 for the maintainer-provided technical description.

Detection Methods for CVE-2026-61741

Indicators of Compromise

Inbound HTTP requests with Content-Type: application/xml or text/xml containing <!DOCTYPE declarations, <!ENTITY definitions, or SYSTEM/PUBLIC identifiers.
Outbound connections from the application process to file://, http://, or ftp:// URIs referenced in XML payloads, especially to internal RFC1918 addresses or cloud metadata endpoints such as 169.254.169.254.
Unexpected reads of local files such as /etc/passwd, application configuration files, or private keys by the JVM process serving http4s traffic.

Detection Strategies

Inspect HTTP request bodies at the gateway or WAF for DOCTYPE and ENTITY tokens targeting routes that consume XML.
Audit dependency manifests (build.sbt, pom.xml) for http4s-scala-xml versions earlier than 0.24.1 or 1.0.0-M39.
Correlate XML POST requests with child-process file reads and outbound network connections initiated by the JVM.

Monitoring Recommendations

Alert on new outbound destinations from application hosts that do not match baseline egress patterns.
Monitor application logs for SAX parsing exceptions referencing unresolved entities or network timeouts fetching external DTDs.
Track latency and memory spikes on XML-handling endpoints, which may indicate entity expansion denial-of-service attempts.

How to Mitigate CVE-2026-61741

Immediate Actions Required

Upgrade http4s-scala-xml to 0.24.1 on the 0.24.x branch or 1.0.0-M39 on the 1.0 milestone branch.
Enumerate all routes using EntityDecoder[F, scala.xml.Elem] and treat them as exposed until the dependency upgrade is deployed.
Rotate any secrets, tokens, or private keys readable by the service account if exploitation is suspected.

Patch Information

Fixed versions are http4s-scala-xml0.24.1 and 1.0.0-M39. The patched releases configure the underlying SAXParserFactory to disable DTDs and external entity resolution. Full remediation details are in the GitHub Security Advisory GHSA-cjx3-73hr-rpw7.

Workarounds

Replace the default decoder with a custom EntityDecoder that constructs a hardened SAXParserFactory, setting disallow-doctype-decl to true and disabling external-general-entities and external-parameter-entities.
Enforce XMLConstants.FEATURE_SECURE_PROCESSING on any SAXParserFactory, DocumentBuilderFactory, or TransformerFactory used in the application.
Block requests containing <!DOCTYPE or <!ENTITY at an upstream proxy or WAF for endpoints that must accept XML.
Restrict egress from application hosts so the JVM cannot reach internal metadata services or arbitrary external URLs during XML parsing.

bash

# Example sbt dependency pin after upgrading
libraryDependencies += "org.http4s" %% "http4s-scala-xml" % "0.24.1"