{"action":"Upgrade org.http4s:http4s-scala-xml_2.13 to 0.24.1 (0.x) or 1.0.0-M39 (1.x) or later.","affected":[{"fixed":"0.24.1","introduced":"0"},{"fixed":"1.0.0-M39","introduced":"1.0.0-M1"}],"component":"org.http4s:http4s-scala-xml_2.13","cve_ids":["CVE-2026-61741"],"ecosystem":"Maven","epss":0.00294,"exploited":false,"fixed_versions":["0.24.1","1.0.0-M39"],"ghsa_id":"GHSA-cjx3-73hr-rpw7","id":"tcs_01M5N8SMKJS53ZT6BH73SE5MPB","modified_at":"2026-09-24T19:45:05.160315055Z","published_at":"2026-09-24T19:35:16Z","references":["https://osv.dev/vulnerability/GHSA-cjx3-73hr-rpw7","https://github.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7","https://nvd.nist.gov/vuln/detail/CVE-2026-61741","https://github.com/http4s/http4s-scala-xml/commit/326f965a2c45fc2ddbc22545dcf551b0f719f4c8","https://github.com/http4s/http4s-scala-xml","https://github.com/http4s/http4s-scala-xml/releases/tag/v0.24.1","https://github.com/http4s/http4s-scala-xml/releases/tag/v1.0.0-M39"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-cjx3-73hr-rpw7#Maven/org.http4s:http4s-scala-xml_2.13","url":"https://osv.dev/vulnerability/GHSA-cjx3-73hr-rpw7"}],"summary":"http4s-scala-xml has an XML External Entity (XXE) processing issue"}