assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)

🗓️ 21 Sep 2026 03:06:16Reported by RedHatType

redhat🔗 access.redhat.com👁 4 Views

Remote XXE in AssertJ XmlStringPrettyFormatter enabling info disclosure, SSRF, and DoS.

Reporter	Title	Published	Views	Family All 108
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	1 Apr 202607:22	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: XML External Entity (XXE) vulnerability (CVE-2026-24400)	11 May 202618:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operator for Apache Flink is affected by a vulnerability in AssertJ library (CVE-2026-24400)	14 May 202610:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in AssertJ (CVE-2026-24400)	24 Mar 202620:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operator for Apache Flink is affected by a vulnerability in AssertJ library (CVE-2026-24400)	14 May 202609:59	–	ibm
attackerkb	CVE-2026-24400	26 Jan 202622:19	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : assertj-core, assertj-core-javadoc (ALAS2023-2026-1448)	6 Mar 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2026-1449)	6 Mar 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : assertj-core (ALSA-2026:59372)	28 Aug 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : assertj-core (ALSA-2026:60215)	27 Aug 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	10.0	noarch	assertj-core	3.24.2-9.el10_0.1	assertj-core-3.24.2-9.el10_0.1.noarch.rpm
Red Hat Enterprise Linux	10.0	noarch	assertj-core-javadoc	3.24.2-9.el10_0.1	assertj-core-javadoc-3.24.2-9.el10_0.1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-24400
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
cheatsheetseries	www.cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
github	www.github.com/assertj/assertj/commit/85ca7eb6609bb179c043b85ae7d290523b1ba79a
github	www.github.com/assertj/assertj/releases/tag/assertj-build-3.27.7
github	www.github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9r
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-24400
cve	www.cve.org/CVERecord

21 Sep 2026 17:13Current

CVSS 3.19.1

CVSS 48.2

EPSS0.00539

SSVC

AssertJ XmlStringPrettyFormatter XXE SSRF unix