CVE-2026-61741
3 advisories.
Maven/org.http4s:http4s-scala-xml_2.12 CVE-2026-61741: critical 9.3
http4s-scala-xml has an XML External Entity (XXE) processing issue
Action: Upgrade org.http4s:http4s-scala-xml_2.12 to 0.24.1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.24.1 | - |
Fixed versions
| 0.24.1 |
Sources
- osv: GHSA-cjx3-73hr-rpw7
- https://github.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7
- https://nvd.nist.gov/vuln/detail/CVE-2026-61741
- https://github.com/http4s/http4s-scala-xml/commit/326f965a2c45fc2ddbc22545dcf551b0f719f4c8
- https://github.com/http4s/http4s-scala-xml
- https://github.com/http4s/http4s-scala-xml/releases/tag/v0.24.1
- https://github.com/http4s/http4s-scala-xml/releases/tag/v1.0.0-M39
CVE-2026-61741 · published · modified · JSON
Maven/org.http4s:http4s-scala-xml_2.13 CVE-2026-61741: critical 9.3
http4s-scala-xml has an XML External Entity (XXE) processing issue
Action: Upgrade org.http4s:http4s-scala-xml_2.13 to 0.24.1 (0.x) or 1.0.0-M39 (1.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.24.1 | - |
| 1.0.0-M1 | 1.0.0-M39 | - |
Fixed versions
| 0.24.1 | 1.0.0-M39 |
Sources
- osv: GHSA-cjx3-73hr-rpw7#Maven/org.http4s:http4s-scala-xml_2.13
- https://github.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7
- https://nvd.nist.gov/vuln/detail/CVE-2026-61741
- https://github.com/http4s/http4s-scala-xml/commit/326f965a2c45fc2ddbc22545dcf551b0f719f4c8
- https://github.com/http4s/http4s-scala-xml
- https://github.com/http4s/http4s-scala-xml/releases/tag/v0.24.1
- https://github.com/http4s/http4s-scala-xml/releases/tag/v1.0.0-M39
CVE-2026-61741 · published · modified · JSON
Maven/org.http4s:http4s-scala-xml_3 CVE-2026-61741: critical 9.3
http4s-scala-xml has an XML External Entity (XXE) processing issue
Action: Upgrade org.http4s:http4s-scala-xml_3 to 0.24.1 (0.x) or 1.0.0-M39 (1.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.24.1 | - |
| 1.0.0-M1 | 1.0.0-M39 | - |
Fixed versions
| 0.24.1 | 1.0.0-M39 |
Sources
- osv: GHSA-cjx3-73hr-rpw7#Maven/org.http4s:http4s-scala-xml_3
- https://github.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7
- https://nvd.nist.gov/vuln/detail/CVE-2026-61741
- https://github.com/http4s/http4s-scala-xml/commit/326f965a2c45fc2ddbc22545dcf551b0f719f4c8
- https://github.com/http4s/http4s-scala-xml
- https://github.com/http4s/http4s-scala-xml/releases/tag/v0.24.1
- https://github.com/http4s/http4s-scala-xml/releases/tag/v1.0.0-M39
CVE-2026-61741 · published · modified · JSON