CVE-2024-55875: http4k XXE and DoS in XML parsing

CVE-2024-55875 · Severity: critical · CVSS 9.8 · Published 2024-12-12

A vulnerability exists in the http4k library, a toolkit used for building Kotlin HTTP applications. When processing XML data from users, the library does not properly restrict external entities or document type declarations. This could allow an attacker to read sensitive files from the server, perform unauthorized internal network requests, or cause a service outage through resource exhaustion.

Vendors: Http4k, Maven.

Quick answers

Is CVE-2024-55875 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-55875 being exploited in the wild.
How severe is CVE-2024-55875?
Critical severity, with a CVSS score of 9.8, published 12 December 2024.
Which products and versions are affected?
Http4k-Format-Xml < 6.50.0.0; org.http4k:http4k-format-xml (Maven) < 6.50.0.0, ECOSYSTEM:introduced=0,fixed=6.50.0.0.
Is there a fix for CVE-2024-55875?
Yes. org.http4k:http4k-format-xml (Maven): upgrade to 6.50.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-55875 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-55875?
Check whether you run Http4k-Format-Xml or org.http4k:http4k-format-xml (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.http4k:http4k-format-xml (Maven): upgrade to 6.50.0.0 or later
    # set org.http4k:http4k-format-xml to 6.50.0.0 in your pom.xml or build.gradle

Technical details

The http4k-format-xml module uses a DocumentBuilderFactory that, by default, does not disable external entity resolution or DTD processing. An unauthenticated remote attacker can send a crafted XML payload to an endpoint using Body.xml() or Document.asXmlDocument() to trigger XXE, leading to SSRF or local file disclosure. While initial fixes (v5.41.0.0) addressed external entities, a residual gap allowed for 'billion laughs' style internal entity expansion attacks. The final fix in v6.50.0.0 fully mitigates these by setting disallow-doctype-decl=true and FEATURE_SECURE_PROCESSING=true.

Affected products

  • http4k http4k-format-xml < 6.50.0.0

Identifiers

  • CVE-2024-55875
  • GHSA-7mj5-hjjj-8rgw

Timeline

  • 2024-12-12: advisory: Initial advisory published for XXE vulnerability
  • 2024-12-12: patched: Initial fix released in v5.41.0.0 / v4.50.0.0
  • 2026-05-31: patched: Follow-up patch v6.50.0.0 released to address residual DoS risks

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.