Executive brief
http4s-scala-xml is a Scala library that handles XML message parsing in HTTP services. The library's XML decoder does not properly restrict external entity resolution, allowing attackers to exploit XML External Entity (XXE) attacks. A malicious request can leak sensitive files from the server, access internal systems via SSRF, or crash the service through denial-of-service attacks.
Technical details
The vulnerability exists in http4s-scala-xml's EntityDecoder[F, scala.xml.Elem] implementation, which instantiates javax.xml.parsers.SAXParserFactory without security hardening. The default JDK configuration permits DOCTYPE declarations and resolution of external general/parameter entities and external DTDs, enabling XXE attacks. Any application using these decoders to parse untrusted XML input is affected; no authentication is required—the attacker only needs to send a crafted XML request. An exploit can disclose local files, perform SSRF against internal resources, or cause denial of service through entity expansion. A fix is available that disables DOCTYPE declarations, external entity/DTD loading, and DTD URI resolution, matching scala.xml.XMLLoader defaults since version 2.0.0.
Affected products
- http4s http4s-scala-xml <UNKNOWN>
Timeline
- 2026-09-24: disclosed
- patched: Fix available; secure processing enabled, DOCTYPE disallowed, external entities disabled