Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2026-24400

critical

CVE-2026-24400

assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)

Published Modified CWE 611
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GHSA8.2CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N
Red Hat6.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Azure Linux (high), Red Hat (medium), AlmaLinux (medium), Amazon (medium), Oracle (medium), Rocky Linux (medium).

Description

AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.

Affected packages and fixed versions

SourcePackageFixed in
alma 10assertj-core, assertj-core-javadoc3.24.2-9.el10_2.1
alma 9assertj-core3.19.0-9.el9_8.1
amazon linux 2023assertj-core, assertj-core-javadoc, javapackages-bootstrap3.19.0-5.amzn2023.0.4 and 1 more
Azure Linux 3.0javapackages-bootstrap0:1.14.0-4.azl3
debian 11assertj-coreno fix listed
debian 12assertj-coreno fix listed
debian 13assertj-coreno fix listed
debian 14assertj-coreno fix listed
echoassertj-coreno fix listed
maven::GitHub Security Advisory Mavenorg.assertj:assertj-core3.27.7
Oracle Linux 9assertj-core3.19.0-9.el9_8.1
rapidfort alma 10assertj-core, assertj-core-javadoc0:3.24.2-9.el10_0.1, 3.24.2-9.el10_2.1
Show all 31 entries from 22 sources
SourcePackageFixed in
alma 10assertj-core3.24.2-9.el10_2.1
alma 10assertj-core-javadoc3.24.2-9.el10_2.1
alma 9assertj-core3.19.0-9.el9_8.1
amazon linux 2023assertj-core3.19.0-5.amzn2023.0.4
amazon linux 2023assertj-core-javadoc3.19.0-5.amzn2023.0.4
amazon linux 2023javapackages-bootstrap1.5.0^20220105.git9f283b7-3.amzn2023.0.8
Azure Linux 3.0javapackages-bootstrap0:1.14.0-4.azl3
debian 11assertj-coreno fix listed
debian 12assertj-coreno fix listed
debian 13assertj-coreno fix listed
debian 14assertj-coreno fix listed
echoassertj-coreno fix listed
maven::GitHub Security Advisory Mavenorg.assertj:assertj-core3.27.7
Oracle Linux 9assertj-core3.19.0-9.el9_8.1
rapidfort alma 10assertj-core0:3.24.2-9.el10_0.1, 3.24.2-9.el10_2.1
rapidfort alma 10assertj-core-javadoc0:3.24.2-9.el10_0.1, 3.24.2-9.el10_2.1
rapidfort alma 9assertj-core3.19.0-9.el9_8.1
rapidfort amazon linux 2023assertj-core3.19.0-5.amzn2023.0.4
rapidfort amazon linux 2023assertj-core-javadoc3.19.0-5.amzn2023.0.4
rapidfort debian 12assertj-coreno fix listed
rapidfort debian 13assertj-coreno fix listed
rapidfort Oracle Linux 10assertj-core0:3.24.2-9.el10_2.1
rapidfort Oracle Linux 9assertj-core0:3.19.0-9.el9_8.1
rapidfort rocky 9assertj-core0:3.19.0-9.el9_8.1
Red Hatjavapackages-tools:201801::assertj-coreno fix listed
Red Hatjavapackages-tools:201801::assertj-core-javadocno fix listed
Red Hatlog4jno fix listed
Red Hatlog4j-jclno fix listed
Red Hatlog4j-slf4jno fix listed
rocky 10assertj-core3.24.2-9.el10_2.1
rocky 9assertj-core3.19.0-9.el9_8.1

References

All 17 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.