assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)

🗓️ 24 Aug 2026 10:53:32Reported by RedHatType

redhat🔗 access.redhat.com👁 3 Views

XXE in AssertJ XmlStringPrettyFormatter enables file read, SSRF, or DoS via isXmlEqualTo.

Reporter	Title	Published	Views	Family All 61
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	1 Apr 202607:22	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: XML External Entity (XXE) vulnerability (CVE-2026-24400)	11 May 202618:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operator for Apache Flink is affected by a vulnerability in AssertJ library (CVE-2026-24400)	14 May 202610:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in AssertJ (CVE-2026-24400)	24 Mar 202620:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operator for Apache Flink is affected by a vulnerability in AssertJ library (CVE-2026-24400)	14 May 202609:59	–	ibm
ATTACKERKB	CVE-2026-24400	26 Jan 202622:19	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : assertj-core, assertj-core-javadoc (ALAS2023-2026-1448)	6 Mar 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2026-1449)	6 Mar 202600:00	–	nessus
Tenable Nessus	openSUSE 16 Security Update : assertj-core (openSUSE-SU-2026:20298-1)	6 Mar 202600:00	–	nessus
Tenable Nessus	Oracle Database Server (April 2026 CPU)	24 Apr 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9.2	noarch	assertj-core	3.19.0-5.el9_2.2	assertj-core-3.19.0-5.el9_2.2.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-24400
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
cheatsheetseries	www.cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
github	www.github.com/assertj/assertj/commit/85ca7eb6609bb179c043b85ae7d290523b1ba79a
github	www.github.com/assertj/assertj/releases/tag/assertj-build-3.27.7
github	www.github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9r
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-24400
cve	www.cve.org/CVERecord

24 Aug 2026 11:32Current

7.8High risk

Vulners AI Score7.8

CVSS 3.19.1

CVSS 48.2

EPSS0.00542

SSVC

AssertJ XML External Entity XmlStringPrettyFormatter information disclosure SSRF denial of service entity expansion