# CVE-2026-61741: http4s-scala-xml XXE vulnerability in EntityDecoder

Source: https://junglewise.ai/threats/cve-2026-61741-http4s-scala-xml-xxe-vulnerability-in-entitydecoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61741 · Severity: critical · CVSS 9.3 · Published 2026-09-24

http4s-scala-xml is a Scala library that handles XML message parsing in HTTP services. The library's XML decoder does not properly restrict external entity resolution, allowing attackers to exploit XML External Entity (XXE) attacks. A malicious request can leak sensitive files from the server, access internal systems via SSRF, or crash the service through denial-of-service attacks.

Vendors: [Http4s](https://junglewise.ai/threats/vendors/http4s), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-61741 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61741 being exploited in the wild.

**How severe is CVE-2026-61741?** Critical severity, with a CVSS score of 9.3, published 24 September 2026.

**Which products and versions are affected?** Http4s-Scala-Xml <UNKNOWN>; org.http4s:http4s-scala-xml_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.24.1; org.http4s:http4s-scala-xml_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.24.1; org.http4s:http4s-scala-xml_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.24.1.

**Is there a fix for CVE-2026-61741?** Yes. org.http4s:http4s-scala-xml_2.12 (Maven): upgrade to 0.24.1 or later; org.http4s:http4s-scala-xml_2.13 (Maven): upgrade to 0.24.1 or later; org.http4s:http4s-scala-xml_3 (Maven): upgrade to 0.24.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61741 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61741?** Check whether you run Http4s-Scala-Xml, org.http4s:http4s-scala-xml_2.12 (Maven), org.http4s:http4s-scala-xml_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.http4s:http4s-scala-xml_2.12 (Maven): upgrade to 0.24.1 or later

  ```sh
  # set org.http4s:http4s-scala-xml_2.12 to 0.24.1 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-scala-xml_2.13 (Maven): upgrade to 0.24.1 or later

  ```sh
  # set org.http4s:http4s-scala-xml_2.13 to 0.24.1 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-scala-xml_3 (Maven): upgrade to 0.24.1 or later

  ```sh
  # set org.http4s:http4s-scala-xml_3 to 0.24.1 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability exists in http4s-scala-xml's EntityDecoder[F, scala.xml.Elem] implementation, which instantiates javax.xml.parsers.SAXParserFactory without security hardening. The default JDK configuration permits DOCTYPE declarations and resolution of external general/parameter entities and external DTDs, enabling XXE attacks. Any application using these decoders to parse untrusted XML input is affected; no authentication is required—the attacker only needs to send a crafted XML request. An exploit can disclose local files, perform SSRF against internal resources, or cause denial of service through entity expansion. A fix is available that disables DOCTYPE declarations, external entity/DTD loading, and DTD URI resolution, matching scala.xml.XMLLoader defaults since version 2.0.0.

## Affected products

- http4s http4s-scala-xml <UNKNOWN>

## Identifiers

- CVE-2026-61741
- GHSA-cjx3-73hr-rpw7

## Timeline

- 2026-09-24: disclosed
- patched: Fix available; secure processing enabled, DOCTYPE disallowed, external entities disabled