Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.http4k:http4k-format-xml

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8MavenPublished

    http4k has a potential XXE (XML External Entity Injection) vulnerability

    CVE-2024-55875 · GHSA-7mj5-hjjj-8rgw

    Affected
    • Maven org.http4k:http4k-format-xml < 6.50.0.0
    Fixed in
    6.50.0.0· Vendor fix available
    Issue
    Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. There is a potential XXE(XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Request Forgery and even execute code under some circumstances. Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. https://github.com/http4k/http4k/blob/25696dff2d90206cc1da42f42a1a8dbcdbcdf18c/core/format/xml/src/main/kotlin/org/http4k/format/Xml.kt#L42-L46 XML contents is parsed with DocumentBuilder without security settings on or external entity enabled PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Example Vulnerable…

    Recommended action: Upgrade to 6.50.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →