CVE-2026-61741: 
Java vulnerability analysis and mitigation

CVE-2026-61741 is an XML External Entity (XXE) injection vulnerability in the http4s-scala-xml library, which provides EntityDecoder[F, scala.xml.Elem] instances for parsing XML message bodies in http4s applications. The root cause is the use of an unconfigured javax.xml.parsers.SAXParserFactory that resolves DOCTYPE declarations, external entities, and external DTDs by default. Affected versions include http4s-scala-xml prior to 0.24.0 (all Scala versions) and 1.0.0-M1 through 1.0.0-M38.1. The vulnerability was originally published on June 24, 2026, and disclosed via NVD on September 24, 2026. It carries a CVSS v3.1 base score of 9.3 (Critical) (GitHub Advisory, Security Advisory).

The vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference). The ElemInstances class in http4s-scala-xml obtains a SAXParserFactory via SAXParserFactory.newInstance() without applying any security hardening — no secure processing flag, no DOCTYPE disallow feature, and no restriction on external entity or DTD resolution. An unauthenticated remote attacker can send a crafted HTTP request body containing a malicious XML document with external entity references (e.g., file:///etc/passwd or an internal network URL) to any endpoint that uses these decoders. No authentication or special privileges are required, and exploitation requires no user interaction (GitHub Advisory, Security Advisory).

Successful exploitation allows an unauthenticated network attacker to disclose local files readable by the service process (e.g., configuration files, credentials, /etc/passwd), perform server-side request forgery (SSRF) to probe or interact with internal network resources not directly accessible, and cause denial of service via entity expansion ("billion laughs"-style attacks). The CVSS scope is marked as Changed, reflecting that the impact extends beyond the vulnerable component itself to internal infrastructure and data stores accessible from the server (GitHub Advisory, Security Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.294%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, XXE vulnerabilities are well-understood and trivially exploitable by any attacker with the ability to send HTTP requests to an affected endpoint, making the low barrier to exploitation a significant concern for unpatched deployments.

1. Reconnaissance: Identify services built with http4s that accept XML request bodies (e.g., REST APIs with Content-Type: application/xml), and confirm they use http4s-scala-xml versions prior to 0.24.1 or between 1.0.0-M1 and 1.0.0-M38.1 (e.g., via dependency manifests, error messages, or version endpoints).
2. Craft XXE payload for file disclosure: Construct a malicious XML body referencing a local file via an external entity:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

3. Send the crafted request: Submit an HTTP POST (or PUT) request to the vulnerable endpoint with the malicious XML body and Content-Type: application/xml header.
4. Observe the response: If the application reflects the parsed XML content in its response, the contents of the referenced file (e.g., /etc/passwd) will be included in the response body.
5. SSRF exploitation: Replace the file:// URI with an internal network URL (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata) to probe internal services.
6. DoS via entity expansion: Craft a recursive entity expansion payload ("billion laughs") to exhaust server memory and cause denial of service (GitHub Advisory, Security Advisory).

• Network: Unexpected outbound HTTP/HTTPS connections from the application server to internal IP ranges (e.g., RFC 1918 addresses) or cloud metadata endpoints (e.g., 169.254.169.254); DNS lookups for attacker-controlled domains originating from the application server process.
• Logs: HTTP access logs showing POST/PUT requests with Content-Type: application/xml containing DOCTYPE, ENTITY, or SYSTEM keywords in the request body; application error logs referencing SAX parser exceptions or external entity resolution failures.
• File System: No direct file system artifacts expected, but evidence of file read attempts may appear in OS-level audit logs (e.g., auditd records for reads of /etc/passwd, /etc/shadow, or application configuration files by the JVM process).
• Process: Unusual network connections initiated by the Java/JVM process (the http4s service) to unexpected internal or external hosts, observable via netstat, ss, or endpoint detection tools.

Upgrade http4s-scala-xml to version 0.24.1 or 1.0.0-M39 (or later), which harden the default SAXParserFactory by enabling secure processing, disallowing DOCTYPE declarations, disabling external entity and DTD loading, and disabling XInclude (GitHub Advisory). If immediate patching is not possible, override ElemInstances#saxFactory with a manually hardened factory instance:

val secured = new ElemInstances {
  override protected val saxFactory = {
    val f = javax.xml.parsers.SAXParserFactory.newInstance
    f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
    // add additional hardening features as needed
    f
  }
}
import secured._

Additionally, restrict XML parsing endpoints to trusted sources only and apply network-level controls to limit outbound connections from the application server (Security Advisory).

The vulnerability was reported by rossabaker (the library maintainer) and reviewed by samspills, indicating responsible disclosure within the http4s project (Security Advisory). The Hacker Wire published a dedicated article highlighting the critical severity and SSRF/file disclosure risks (The Hacker Wire). A Mastodon post from The Hacker Wire also amplified awareness of the vulnerability in the security community.