https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 25 Sep 2026 19:52:21 +0000 https://vulnerability.circl.lu/sighting/786ec43a-f16f-4a26-b1f2-595bf2fb648f/export {"uuid": "786ec43a-f16f-4a26-b1f2-595bf2fb648f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61741", "type": "seen", "source": "https://gist.github.com/alon710/3908807e8c617e39340726cbf7670bd2", "content": "# CVE-2026-61741: CVE-2026-61741: XML External Entity (XXE) Injection in http4s-scala-xml\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61741\n\n## Summary\nCVE-2026-61741 is a critical XML External Entity (XXE) injection vulnerability in the http4s-scala-xml library. The vulnerability allows remote, unauthenticated attackers to perform arbitrary local file disclosure, execute server-side request forgery (SSRF) attacks, or cause denial of service via recursive entity expansion. The vulnerability stems from the use of an unconfigured SAXParserFactory, which enables external entity resolution by default.\n\n## TL;DR\nAn unauthenticated remote code-execution and disclosure vulnerability (XXE) exists in http4s-scala-xml due to an unhardened SAXParserFactory. Attackers can exploit this to read local host files, target internal networks via SSRF, or trigger denial of service via CPU/memory exhaustion.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-611\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.3\n- **Impact**: Confidentiality: High, Availability: Low, Integrity: None\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- http4s-scala-xml library configurations running within scala-based JVM environments\n- **http4s-scala-xml**: < 0.24.1 (Fixed in: `0.24.1`)\n- **http4s-scala-xml**: >= 1.0.0-M1, < 1.0.0-M39 (Fixed in: `1.0.0-M39`)\n\n## Mitigation\n\n- Upgrade http4s-scala-xml to 0.24.1 or 1.0.0-M39 immediately.\n- Disable parsing of inline DOCTYPE declarations in any custom SAXParserFactory instances.\n- Deploy WAF rules to detect and reject HTTP POST/PUT requests containing XML DTD definitions.\n\n**Remediation Steps:**\n1. Open the project's dependency definition file (e.g., build.sbt).\n2. Locate the library dependency reference for 'org.http4s' %% 'http4s-scala-xml'.\n3. Update the version string to '0.24.1' or '1.0.0-M39' depending on the active release train.\n4. Reload the project configuration and execute a clean build to enforce dependency resolution.\n5. Run automated security scanning tools to verify that vulnerable instances have been evicted.\n\n## References\n\n- [GHSA-cjx3-73hr-rpw7](https://github.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7)\n- [Mitigation Commit](https://github.com/http4s/http4s-scala-xml/commit/326f965a2c45fc2ddbc22545dcf551b0f719f4c8)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-61741)\n- [CVE.org CVE-2026-61741](https://www.cve.org/CVERecord?id=CVE-2026-61741)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61741) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T14:30:32.000000Z"} {"uuid": "786ec43a-f16f-4a26-b1f2-595bf2fb648f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61741", "type": "seen", "source": "https://gist.github.com/alon710/3908807e8c617e39340726cbf7670bd2", "content": "# CVE-2026-61741: CVE-2026-61741: XML External Entity (XXE) Injection in http4s-scala-xml\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61741\n\n## Summary\nCVE-2026-61741 is a critical XML External Entity (XXE) injection vulnerability in the http4s-scala-xml library. The vulnerability allows remote, unauthenticated attackers to perform arbitrary local file disclosure, execute server-side request forgery (SSRF) attacks, or cause denial of service via recursive entity expansion. The vulnerability stems from the use of an unconfigured SAXParserFactory, which enables external entity resolution by default.\n\n## TL;DR\nAn unauthenticated remote code-execution and disclosure vulnerability (XXE) exists in http4s-scala-xml due to an unhardened SAXParserFactory. Attackers can exploit this to read local host files, target internal networks via SSRF, or trigger denial of service via CPU/memory exhaustion.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-611\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.3\n- **Impact**: Confidentiality: High, Availability: Low, Integrity: None\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- http4s-scala-xml library configurations running within scala-based JVM environments\n- **http4s-scala-xml**: < 0.24.1 (Fixed in: `0.24.1`)\n- **http4s-scala-xml**: >= 1.0.0-M1, < 1.0.0-M39 (Fixed in: `1.0.0-M39`)\n\n## Mitigation\n\n- Upgrade http4s-scala-xml to 0.24.1 or 1.0.0-M39 immediately.\n- Disable parsing of inline DOCTYPE declarations in any custom SAXParserFactory instances.\n- Deploy WAF rules to detect and reject HTTP POST/PUT requests containing XML DTD definitions.\n\n**Remediation Steps:**\n1. Open the project's dependency definition file (e.g., build.sbt).\n2. Locate the library dependency reference for 'org.http4s' %% 'http4s-scala-xml'.\n3. Update the version string to '0.24.1' or '1.0.0-M39' depending on the active release train.\n4. Reload the project configuration and execute a clean build to enforce dependency resolution.\n5. Run automated security scanning tools to verify that vulnerable instances have been evicted.\n\n## References\n\n- [GHSA-cjx3-73hr-rpw7](https://github.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7)\n- [Mitigation Commit](https://github.com/http4s/http4s-scala-xml/commit/326f965a2c45fc2ddbc22545dcf551b0f719f4c8)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-61741)\n- [CVE.org CVE-2026-61741](https://www.cve.org/CVERecord?id=CVE-2026-61741)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61741) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T14:30:32.000000Z"} https://vulnerability.circl.lu/sighting/786ec43a-f16f-4a26-b1f2-595bf2fb648f/export Fri, 25 Sep 2026 14:30:32 +0000 https://vulnerability.circl.lu/sighting/2e3581c9-2e84-432b-8a64-f22e47b55c8a/export {"uuid": "2e3581c9-2e84-432b-8a64-f22e47b55c8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61741", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwc2o3ndrp2l", "content": "\ud83d\udea8 CVE-2026-61741 \u2014 CVSS 9.3 CRITICAL\n\nhttp4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-61741\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-24T20:08:01.429501Z"} {"uuid": "2e3581c9-2e84-432b-8a64-f22e47b55c8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61741", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwc2o3ndrp2l", "content": "\ud83d\udea8 CVE-2026-61741 \u2014 CVSS 9.3 CRITICAL\n\nhttp4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-61741\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-24T20:08:01.429501Z"} https://vulnerability.circl.lu/sighting/2e3581c9-2e84-432b-8a64-f22e47b55c8a/export Thu, 24 Sep 2026 20:08:01 +0000 https://vulnerability.circl.lu/sighting/e0319170-439f-4ebe-bf37-e63a8b09226d/export {"uuid": "e0319170-439f-4ebe-bf37-e63a8b09226d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61741", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwbvquf5qk2r", "content": "CVE-2026-61741 - http4s-scala-xml\nThe XML handling component in http4s-scala-xml can read untrusted XML without safety checks. This can let an attacker cause the service to reveal local files, contact internal\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#http4s #CVE #infosec", "creation_timestamp": "2026-09-24T18:40:05.859792Z"} {"uuid": "e0319170-439f-4ebe-bf37-e63a8b09226d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61741", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwbvquf5qk2r", "content": "CVE-2026-61741 - http4s-scala-xml\nThe XML handling component in http4s-scala-xml can read untrusted XML without safety checks. This can let an attacker cause the service to reveal local files, contact internal\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#http4s #CVE #infosec", "creation_timestamp": "2026-09-24T18:40:05.859792Z"} https://vulnerability.circl.lu/sighting/e0319170-439f-4ebe-bf37-e63a8b09226d/export Thu, 24 Sep 2026 18:40:05 +0000