CVE-2024-55875
1 advisory.
Maven/org.http4k:http4k-format-xml CVE-2024-55875: critical 9.8
http4k has a potential XXE (XML External Entity Injection) vulnerability
Action: Upgrade org.http4k:http4k-format-xml to 6.50.0.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.50.0.0 | - |
Fixed versions
| 6.50.0.0 |
Sources
- osv: GHSA-7mj5-hjjj-8rgw
- https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgw
- https://nvd.nist.gov/vuln/detail/CVE-2024-55875
- https://github.com/http4k/http4k/commit/35297adc6d6aca4951d50d8cdf17ff87a8b19fbc
- https://github.com/http4k/http4k
- https://github.com/http4k/http4k/blob/25696dff2d90206cc1da42f42a1a8dbcdbcdf18c/core/format/xml/src/main/kotlin/org/http4k/format/Xml.kt#L42-L46
CVE-2024-55875 · published · modified · JSON