Maven/org.http4s:http4s-scala-xml_2.12 CVE-2026-61741: critical 9.3, EPSS 0.29%
http4s-scala-xml has an XML External Entity (XXE) processing issue
Action: Upgrade org.http4s:http4s-scala-xml_2.12 to 0.24.1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.24.1 | - |
Fixed versions
| 0.24.1 |
Sources
- osv: GHSA-cjx3-73hr-rpw7
- https://github.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7
- https://nvd.nist.gov/vuln/detail/CVE-2026-61741
- https://github.com/http4s/http4s-scala-xml/commit/326f965a2c45fc2ddbc22545dcf551b0f719f4c8
- https://github.com/http4s/http4s-scala-xml
- https://github.com/http4s/http4s-scala-xml/releases/tag/v0.24.1
- https://github.com/http4s/http4s-scala-xml/releases/tag/v1.0.0-M39
CVE-2026-61741 · published · modified · JSON