{"action":"Upgrade org.http4k:http4k-format-xml to 6.50.0.0 or later.","affected":[{"fixed":"6.50.0.0","introduced":"0"}],"component":"org.http4k:http4k-format-xml","cve_ids":["CVE-2024-55875"],"ecosystem":"Maven","epss":0.01905,"exploited":false,"fixed_versions":["6.50.0.0"],"ghsa_id":"GHSA-7mj5-hjjj-8rgw","id":"tcs_01M5N8JQ40VZ8APKER10NAB2VG","modified_at":"2026-06-09T10:45:14.057577371Z","published_at":"2024-12-12T19:22:01Z","references":["https://osv.dev/vulnerability/GHSA-7mj5-hjjj-8rgw","https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgw","https://nvd.nist.gov/vuln/detail/CVE-2024-55875","https://github.com/http4k/http4k/commit/35297adc6d6aca4951d50d8cdf17ff87a8b19fbc","https://github.com/http4k/http4k","https://github.com/http4k/http4k/blob/25696dff2d90206cc1da42f42a1a8dbcdbcdf18c/core/format/xml/src/main/kotlin/org/http4k/format/Xml.kt#L42-L46"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-7mj5-hjjj-8rgw","url":"https://osv.dev/vulnerability/GHSA-7mj5-hjjj-8rgw"}],"summary":"http4k has a potential XXE (XML External Entity Injection) vulnerability"}