7 matches found
CVE-2026-61741
http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...
CVE-2026-61741 http4s-scala-xml has an XML External Entity (XXE) processing issue
http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...
CVE-2026-61741
The http4s-scala-xml library is vulnerable to XML External Entity (XXE) attacks in versions prior to 0.24.1 and 1.0.0-M39 . The root cause is the use of SAXParserFactory.newInstance to obtain a javax.xml.parsers.SAXParserFactory without any security configuration, allowing the parser to resolve D...
EUVD-2026-86332
http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...
CVE-2026-61741
http4s-scala-xml provides "EntityDecoderF, scala.xml.Elem" instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a "javax.xml.parsers.SAXParserFactory" obtained from "SAXParserFactory.newInstance" without any security configuration. With the JDK's...
CVE-2026-61741: Improper Restriction of XML External Entity Reference
http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...
PT-2026-98218
Name of the Vulnerable Software and Affected Versions http4s-scala-xml versions prior to 0.24.1 http4s-scala-xml versions prior to 1.0.0-M39 Description EntityDecoderF, scala.xml.Elem instances used to parse XML message bodies utilize a javax.xml.parsers.SAXParserFactory without security...