The vulnerable component, http4s‑scala‑xml, previously instantiated a SAXParser with default settings that resolve DOCTYPE declarations and external entities. This flaw enables untrusted XML payloads to trigger XML External Entity (XXE) attacks, allowing an attacker to read local files visible to the service process, perform server‑side request forgery against internal resources, or cause denial of service through entity expansion. The weakness maps to CWE‑611 and can compromise confidentiality, integrity, and availability.

Affected products include http4s:http4s-scala-xml. Versions prior to 0.24.1 and 1.0.0‑M39 are vulnerable. Unsupported or older releases lacking the patch do not mitigate the issue.

The CVSS score of 9.3 indicates critical severity. The EPSS is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is application‑level: an attacker sends a crafted XML request to a system utilizing the vulnerable decoder. Successful exploitation requires only exposure of untrusted XML; no additional privileges are needed. Once executed, the attacker can disclose sensitive files, tunnel traffic to internal hosts, or overwhelm the service with large entity expansions.