Log in Start free

Vulnerability · Published Jan 26, 2026 · Assigned by GitHub_M

CVE-2026-24400AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion

High 8.2

In plain English

A high-severity XML external entity in assertj from assertj. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.6%top 52.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10assertj-core3.24.2-9.el10_2.1ALSA-2026:59372
AlmaLinux:9assertj-core3.19.0-9.el9_8.1ALSA-2026:60215
AlmaLinux:10assertj-core-javadoc3.24.2-9.el10_2.1ALSA-2026:59372
Debian:12assertj-coreno fix listedDEBIAN-CVE-2026-24400
Debian:13assertj-coreno fix listedDEBIAN-CVE-2026-24400
Debian:14assertj-coreno fix listedDEBIAN-CVE-2026-24400
Mavenorg.assertj:assertj-core3.27.7GHSA-rqfh-9r24-8c9r
Rocky Linux:10assertj-core0:3.24.2-9.el10_2.1RLSA-2026:59372
Rocky Linux:9assertj-core0:3.19.0-9.el9_8.1RLSA-2026:60215
Ubuntu:22.04:LTSassertj-coreno fix listedUBUNTU-CVE-2026-24400
Ubuntu:24.04:LTSassertj-coreno fix listedUBUNTU-CVE-2026-24400
Ubuntu:25.10assertj-coreno fix listedUBUNTU-CVE-2026-24400
Ubuntu:26.04:LTSassertj-coreno fix listedUBUNTU-CVE-2026-24400
Ubuntu:26.10assertj-coreno fix listedUBUNTU-CVE-2026-24400

Affected products (as reported)

VendorProductVersions
assertj assertj >= 1.4.0, < 3.27.7

Weakness: CWE-611 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

References