CVE-2026-24400 AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
Attackers can read local files, cause SSRF, or trigger DoS via XXE in AssertJ's XML assertions when processing untrusted input.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24400?
CVE-2026-24400 is a high-severity vulnerability in assertj, published on 26 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.
Weakness: CWE-611
Which versions are affected by CVE-2026-24400?
2 open source packages ship an affected version, including org.assertj:assertj-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.assertj:assertj-core Maven | From 1.4.0 | 3.27.7 |
org.assertj:assertj-core Maven | From 1.4.0 | 3.27.7 |
Linux distribution packages (18)
assertj-core AlmaLinux:10 | All versions | 3.24.2-9.el10_2.1 |
assertj-core-javadoc AlmaLinux:10 | All versions | 3.24.2-9.el10_2.1 |
assertj-core AlmaLinux:9 | All versions | 3.19.0-9.el9_8.1 |
assertj-core Red Hat:enterprise_linux:10.2 | All versions | 0:3.24.2-9.el10_2.1 |
assertj-core-javadoc Red Hat:enterprise_linux:10.2 | All versions | 0:3.24.2-9.el10_2.1 |
assertj-core Red Hat:enterprise_linux:9::appstream | All versions | 0:3.19.0-9.el9_8.1 |
assertj-core Red Hat:enterprise_linux_eus:10.0 | All versions | 0:3.24.2-9.el10_0.1 |
assertj-core-javadoc Red Hat:enterprise_linux_eus:10.0 | All versions | 0:3.24.2-9.el10_0.1 |
assertj-core Red Hat:rhel_e4s:9.2::appstream | All versions | 0:3.19.0-5.el9_2.2 |
assertj-core Red Hat:rhel_e4s:9.4::appstream | All versions | 0:3.19.0-5.el9_4.2 |
assertj-core Red Hat:rhel_eus:9.6::appstream | All versions | 0:3.19.0-9.el9_6.1 |
assertj-core Rocky Linux:10 | All versions | 0:3.24.2-9.el10_2.1 |
assertj-core Rocky Linux:9 | All versions | 0:3.19.0-9.el9_8.1 |
assertj-core SUSE:Linux Enterprise Server 16.0 | All versions | 3.27.7-160000.1.1 |
assertj-core SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 3.27.7-160000.1.1 |
assertj-core openSUSE:Leap 15.6 | All versions | 3.27.7-150200.5.9.2 |
assertj-core openSUSE:Leap 16.0 | All versions | 3.27.7-160000.1.1 |
assertj-core openSUSE:Tumbleweed | All versions | 3.27.7-1.1 |
Products include Assertj Assertj.
How do I fix CVE-2026-24400?
Upgrade org.assertj:assertj-core to 3.27.7 or later.
Is CVE-2026-24400 being exploited?
There is no known exploitation of CVE-2026-24400 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:59372, ALSA-2026:60215, AZL-75431, CLSA-2026-1783558957, CLSA-2026-1783904622, CLSA-2026-1783991040 and 68 more.