XXE Flaw in http4s-scala-xml Lets Attackers Read Files and Trigger SSRF (CVE-2026-61741)

GitHub Security Advisory GHSA-cjx3-73hr-rpw7 discloses an XML External Entity (XXE) vulnerability in http4s-scala-xml, tracked as CVE-2026-61741 with a reported CVSS of 9.3 and a public proof-of-concept. According to the advisory, the library's EntityDecoder[F, scala.xml.Elem] instances build a javax.xml.parsers.SAXParserFactory via SAXParserFactory.newInstance without hardening it. Under the JDK's default settings, that factory resolves DOCTYPE declarations, external general/parameter entities, and external DTDs — the classic ingredients for XXE.

Why It Matters

Any Scala service built on http4s that uses this library's decoders to parse XML from untrusted requests is potentially exposed. The advisory states the flaw can lead to disclosure of local files readable by the service process, server-side request forgery (SSRF) against internal network resources, and denial of service via entity expansion. The affected packages span all supported Scala versions: org.http4s:http4s-scala-xml_2.12, _2.13, and _3.

What Defenders Should Do Now

• Inventory services that depend on http4s-scala-xml and confirm whether they parse externally-supplied XML into scala.xml.Elem.
• Upgrade to the patched release, which hardens the default SAXParserFactory — enabling secure processing, disallowing DOCTYPE declarations, disabling external entity/DTD resolution, and disabling XInclude — matching scala.xml.XMLLoader's defaults since 2.0.0.
• If upgrading isn't immediately possible, apply the advisory's workaround: override ElemInstances#saxFactory with a hardened SAXParserFactory that explicitly disables DOCTYPE and external entity resolution.
• At the network/monitoring level, watch for outbound requests originating from XML-parsing services to unexpected internal hosts (SSRF indicators), unusual file-read patterns by the service process, and abnormal memory/CPU spikes correlated with inbound XML payloads (entity-expansion DoS).
• Review any WAF or ingress filtering for XML payloads containing <!DOCTYPE or external entity declarations targeting these endpoints as an interim compensating control.

This is a same-day advisory and details may evolve as the ecosystem responds; treat this as developing intel rather than a finalized picture. For the full technical write-up, patch guidance, and workaround code, see the original GitHub Security Advisory: GHSA-cjx3-73hr-rpw7.