Security readout for executives and security teams
Plain-English summary
Applications using http4k to parse untrusted XML may be exposed to serious XML parser attacks. Sources say affected versions are before 6.50.0.0. Older exposure included external-entity risks such as sensitive file disclosure and SSRF; a later residual gap allowed denial-of-service through DOCTYPE-based internal entity expansion.
Executive priority
Treat as urgent for internet-facing systems that accept XML. The business risk is data exposure, server-side request forgery, and service outage. Patch vulnerable http4k dependencies and verify XML parsing behavior.
Technical view
CVE-2024-55875 affects http4k XML parsing before 6.50.0.0, especially Body.xml() and Document.asXmlDocument() on untrusted XML. Earlier fixes blocked external DTD and schema access and entity expansion, but still allowed DOCTYPE declarations. Version 6.50.0.0 adds disallow-doctype-decl and secure-processing behavior to defaultXmlParsingConfig.
Likely exposure
Exposure is likely in Kotlin services using vulnerable http4k versions and parsing client-controlled XML request bodies. Services that do not accept XML or do not use http4k XML helpers are less likely exposed.
Exploitation context
The provided bundle does not show known active exploitation, and KEV is false. The issue is still high urgency because it is network-reachable, unauthenticated, low-complexity, and can affect confidentiality, integrity, and availability.
Researcher notes
The sources distinguish between the original external-entity fix and the remaining DOCTYPE acceptance gap. Avoid assuming every affected version has identical impact; validate actual dependency version, parser configuration, and use of http4k XML helpers.
Mitigation direction
- Upgrade http4k to version 6.50.0.0 or later.
- Prioritize externally reachable services that parse XML request bodies.
- Reduce or disable untrusted XML ingestion where it is not required.
- Follow http4k advisory guidance for supported branches and parser behavior.
- Add request size and timeout controls around XML endpoints.
Validation and detection
- Inventory deployed services for http4k versions below 6.50.0.0.
- Search code for Body.xml() and Document.asXmlDocument() usage.
- Map XML parsing paths to public or partner-facing endpoints.
- Confirm upgraded builds reject XML documents containing DOCTYPE declarations.
- Review logs for XML parser errors, SSRF indicators, or resource exhaustion.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-611: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-55875 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/http4k/http4k/security/advisories/GHSA-7mj5-hjjj-8rgwCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/http4k/http4k/commit/35297adc6d6aca4951d50d8cdf17ff87a8b19fbcCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/http4k/http4k/blob/25696dff2d90206cc1da42f42a1a8dbcdbcdf18c/core/format/xml/src/main/kotlin/org/http4k/format/Xml.kt#L42-L46CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.