Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

http4s-scala-xml has an XML External Entity (XXE) processing issue

Fix availableCritical · CVSS 9.3EPSS 0.29%

Published Sep 24, 2026 · updated Sep 24, 2026

What to do

  1. Upgrade to a fixed version: org.http4s:http4s-scala-xml_2.12 0.24.1, org.http4s:http4s-scala-xml_2.13 0.24.1, org.http4s:http4s-scala-xml_2.13 1.0.0-M39, org.http4s:http4s-scala-xml_3 0.24.1 (see table).
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenorg.http4s:http4s-scala-xml_2.12

Vulnerable versions
<= 0.24.0
Fixed in
0.24.1

Check your project: mvn dependency:tree -Dincludes=org.http4s:http4s-scala-xml_2.12

Mavenorg.http4s:http4s-scala-xml_2.13

Vulnerable versions
<= 0.24.0
Fixed in
0.24.1

Check your project: mvn dependency:tree -Dincludes=org.http4s:http4s-scala-xml_2.13

Mavenorg.http4s:http4s-scala-xml_2.13

Vulnerable versions
>= 1.0.0-M1, <= 1.0.0-M38.1
Fixed in
1.0.0-M39

Check your project: mvn dependency:tree -Dincludes=org.http4s:http4s-scala-xml_2.13

Mavenorg.http4s:http4s-scala-xml_3

Vulnerable versions
<= 0.24.0
Fixed in
0.24.1

Check your project: mvn dependency:tree -Dincludes=org.http4s:http4s-scala-xml_3

Mavenorg.http4s:http4s-scala-xml_3

Vulnerable versions
>= 1.0.0-M1, <= 1.0.0-M38.1
Fixed in
1.0.0-M39

Check your project: mvn dependency:tree -Dincludes=org.http4s:http4s-scala-xml_3

Sources

CWE-611 Improper Restriction of XML External Entity Reference

← All critical vulnerabilities