EUVD-2026-86332
GHSA-cjx3-73hr-rpw7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Network-reachable unauthenticated XML parsing yields file disclosure (C:H) and SSRF crossing a trust boundary (S:C); entity-expansion gives limited DoS (A:L), no integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
http4s-scala-xml provides EntityDecoder[F, scala.xml.Elem] instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks. An attacker can craft a request that discloses local files readable by the service process, performs server-side request forgery (SSRF) against internal network resources, and/or causes denial of service through entity expansion. Versions 0.24.1 and 1.0.0-M39 fix the issue.
AnalysisAI
XML External Entity (XXE) injection in http4s-scala-xml's EntityDecoder for scala.xml.Elem (all versions before 0.24.1 and 1.0.0-M39) allows unauthenticated remote attackers who can supply XML message bodies to disclose files readable by the service process, perform server-side request forgery (SSRF) against internal network resources, or trigger denial of service via entity expansion. The decoders obtain a javax.xml.parsers.SAXParserFactory through SAXParserFactory.newInstance without configuring secure-processing features, so JDK default behavior resolves DOCTYPE declarations, external general and parameter entities, and external DTDs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that an http4s application actually use the http4s-scala-xml `EntityDecoder[F, scala.xml.Elem]` (or the `Elem` decoder) to parse XML message bodies from untrusted sources, on a vulnerable version prior to 0.24.1 / 1.0.0-M39 running on a JDK whose default SAXParserFactory resolves DOCTYPE/external entities. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a classic, high-impact XXE (CWE-611) in the http4s-scala-xml `EntityDecoder` for `scala.xml.Elem`, which parsed untrusted XML with an unconfigured `SAXParserFactory` (DOCTYPE, external general/parameter entities, and external DTDs all resolved by JDK defaults). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade http4s-scala-xml to 0.24.1 or 1.0.0-M39, the vendor-released patched versions that configure the SAXParserFactory securely; see the advisory at https://github.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7 for the full release guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every application and service that depends on http4s-scala-xml (including transitive dependencies surfaced through SBOMs or dependency trees) and flag the ones that parse externally supplied XML with the scala.xml.Elem EntityDecoder; for any internet-facing endpoint that cannot be upgraded immediately, harden the JVM XML layer by enabling FEATURE_SECURE_PROCESSING, setting the disallow-doctype-decl feature to true, disabling external-general-entities and external-parameter-entities, and setting ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_SCHEMA to an empty string, and add a reverse-proxy or WAF rule that rejects request bodies containing a DOCTYPE declaration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Http4s client applications that keep a cookie jar can leak stored cookies — including session and authentication cookies
Http4s is a Scala interface for HTTP services. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploita
Request smuggling in the http4s Ember HTTP/1.1 parser lets an unauthenticated, remote attacker bypass front-end access c
Http4s is a minimal, idiomatic Scala interface for HTTP services. Rated critical severity (CVSS 9.1), this vulnerability
HTTP request smuggling in http4s Ember (all releases prior to 0.23.35 and 1.0.0-M47) lets an unauthenticated remote atta
Let me synthesize. CVE-2026-69205: http4s Ember HTTP parser request smuggling via Transfer-Encoding header case-sensiti
http4s is an open source scala interface for HTTP. Rated medium severity (CVSS 4.7), this vulnerability is remotely expl
A crafted WebSocket frame can pin a worker thread and exhaust memory in the http4s Scala HTTP library, causing denial of
Heap exhaustion in the http4s Ember backend (0.23.x before 0.23.35 and 1.0.0 milestones before 1.0.0-M47) allows a singl
Heap-exhaustion denial of service in the http4s DigestAuth server middleware: an inverted stale-nonce comparison in Nonc
Unbounded WebSocket fragment aggregation in http4s-blaze-server allows any client that completes a WebSocket handshake t
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Rated high severity (CVSS 7.5),
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today