CVE-2026-24400
AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values. An application is vulnerable only when it uses untrusted XML input with either isXmlEqualTo(CharSequence) from org.assertj.core.api.AbstractCharSequenceAssert or xmlPrettyFormat(String) from org.assertj.core.util.xml.XmlStringPrettyFormatter. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via file:// URIs (e.g., /etc/passwd, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace isXmlEqualTo(CharSequence) with XMLUnit, upgrade to version 3.27.7, or avoid using isXmlEqualTo(CharSequence) or XmlStringPrettyFormatter with untrusted input. XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values. An application is vulnerable only when it uses untrusted XML input with either isXmlEqualTo(CharSequence) from org.assertj.core.api.AbstractCharSequenceAssert or xmlPrettyFormat(String) from org.assertj.core.util.xml.XmlStringPrettyFormatter. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via file:// URIs (e.g., /etc/passwd, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace isXmlEqualTo(CharSequence) with XMLUnit, upgrade to version 3.27.7, or avoid using isXmlEqualTo(CharSequence) or XmlStringPrettyFormatter with untrusted input. XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.
- Record
CVE-2026-24400- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Weakness
- CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2026-4724
AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values. An application is vulnerable only when it uses untrusted XML input with either isXmlEqualTo(CharSequence) from org.assertj.core.api.AbstractCharSequenceAssert or xmlPrettyFormat(String) from org.assertj.core.util.xml.XmlStringPrettyFormatter. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via file:// URIs (e.g., /etc/passwd, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace isXmlEqualTo(CharSequence) with XMLUnit, upgrade to version 3.27.7, or avoid using isXmlEqualTo(CharSequence) or XmlStringPrettyFormatter with untrusted input. XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.
- Record
EUVD-2026-4724- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rqfh-9r24-8c9r
AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
An XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values.
An application is vulnerable only when it uses untrusted XML input with one of the following methods:
isXmlEqualTo(CharSequence)fromorg.assertj.core.api.AbstractCharSequenceAssertxmlPrettyFormat(String)fromorg.assertj.core.util.xml.XmlStringPrettyFormatter
Impact
If untrusted XML input is processed by the methods mentioned above (e.g., in test environments handling external fixture files), an attacker could:
- Read arbitrary local files via
file://URIs (e.g.,/etc/passwd, application configuration files) - Perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs
- Cause Denial of Service via "Billion Laughs" entity expansion attacks
Mitigation
isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference:
- Replace
isXmlEqualTo(CharSequence)with XMLUnit, or - Upgrade to version 3.27.7, or
- Avoid using
isXmlEqualTo(CharSequence)orXmlStringPrettyFormatterwith untrusted input.
XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.
References
- Record
GHSA-rqfh-9r24-8c9r- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Weakness
- CWE-611
- Updated
- 2026-11-02
NVD
AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values. An application is vulnerable only when it uses untrusted XML input with either isXmlEqualTo(CharSequence) from org.assertj.core.api.AbstractCharSequenceAssert or xmlPrettyFormat(String) from org.assertj.core.util.xml.XmlStringPrettyFormatter. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via file:// URIs (e.g., /etc/passwd, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace isXmlEqualTo(CharSequence) with XMLUnit, upgrade to version 3.27.7, or avoid using isXmlEqualTo(CharSequence) or XmlStringPrettyFormatter with untrusted input. XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.
- Record
CVE-2026-24400- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values. An application is vulnerable only when it uses untrusted XML input with either isXmlEqualTo(CharSequence) from org.assertj.core.api.AbstractCharSequenceAssert or xmlPrettyFormat(String) from org.assertj.core.util.xml.XmlStringPrettyFormatter. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via file:// URIs (e.g., /etc/passwd, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace isXmlEqualTo(CharSequence) with XMLUnit, upgrade to version 3.27.7, or avoid using isXmlEqualTo(CharSequence) or XmlStringPrettyFormatter with untrusted input. XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.
- Record
CVE-2026-24400- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-24400
AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values. An application is vulnerable only when it uses untrusted XML input with either isXmlEqualTo(CharSequence) from org.assertj.core.api.AbstractCharSequenceAssert or xmlPrettyFormat(String) from org.assertj.core.util.xml.XmlStringPrettyFormatter. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via file:// URIs (e.g., /etc/passwd, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace isXmlEqualTo(CharSequence) with XMLUnit, upgrade to version 3.27.7, or avoid using isXmlEqualTo(CharSequence) or XmlStringPrettyFormatter with untrusted input. XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.
- Record
DEBIAN-CVE-2026-24400- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Show 48 moreShow less
OSVGHSA-rqfh-9r24-8c9r
AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
An XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values.
An application is vulnerable only when it uses untrusted XML input with one of the following methods:
isXmlEqualTo(CharSequence)fromorg.assertj.core.api.AbstractCharSequenceAssertxmlPrettyFormat(String)fromorg.assertj.core.util.xml.XmlStringPrettyFormatter
Impact
If untrusted XML input is processed by the methods mentioned above (e.g., in test environments handling external fixture files), an attacker could:
- Read arbitrary local files via
file://URIs (e.g.,/etc/passwd, application configuration files) - Perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs
- Cause Denial of Service via "Billion Laughs" entity expansion attacks
Mitigation
isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference:
- Replace
isXmlEqualTo(CharSequence)with XMLUnit, or - Upgrade to version 3.27.7, or
- Avoid using
isXmlEqualTo(CharSequence)orXmlStringPrettyFormatterwith untrusted input.
XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.
References
- Record
GHSA-rqfh-9r24-8c9r- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVRHLW-2026-04395e330cc28cb3
Lightwell Security Advisory: assertj-core 3.16.0.rhlw-00004
Red Hat Lightwell has released org.assertj:assertj-core 3.16.0.rhlw-00004 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.16.0 from Maven Central.
- Record
RHLW-2026-04395e330cc28cb3- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-06c890c70b401b52
Lightwell Security Advisory: assertj-core 3.4.1.rhlw-00002
Red Hat Lightwell has released org.assertj:assertj-core 3.4.1.rhlw-00002 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.4.1 from Maven Central.
- Record
RHLW-2026-06c890c70b401b52- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-0a09f6ecf7835ea0
Lightwell Security Advisory: assertj-guava 3.25.1.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-guava 3.25.1.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.25.1 from Maven Central.
- Record
RHLW-2026-0a09f6ecf7835ea0- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-125c08589a792d0c
Lightwell Security Advisory: assertj-core 3.14.0.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.14.0.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.14.0 from Maven Central.
- Record
RHLW-2026-125c08589a792d0c- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-1dfa725faa28bd98
Lightwell Security Advisory: assertj-guava 3.26.3.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-guava 3.26.3.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.26.3 from Maven Central.
- Record
RHLW-2026-1dfa725faa28bd98- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-2f00b906a72c7d80
Lightwell Security Advisory: assertj-guava 3.27.5.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-guava 3.27.5.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.27.5 from Maven Central.
- Record
RHLW-2026-2f00b906a72c7d80- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-3c10659b7340e612
Lightwell Security Advisory: assertj-core 3.18.1.rhlw-00003
Red Hat Lightwell has released org.assertj:assertj-core 3.18.1.rhlw-00003 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.18.1 from Maven Central.
- Record
RHLW-2026-3c10659b7340e612- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-3f93bdcc94a21f2e
Lightwell Security Advisory: assertj-core 3.22.0.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.22.0.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.22.0 from Maven Central.
- Record
RHLW-2026-3f93bdcc94a21f2e- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-44bcd6e79804e6f9
Lightwell Security Advisory: assertj-core 3.9.1.rhlw-00005
Red Hat Lightwell has released org.assertj:assertj-core 3.9.1.rhlw-00005 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.9.1 from Maven Central.
- Record
RHLW-2026-44bcd6e79804e6f9- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-4688fa8056bb5eb0
Lightwell Security Advisory: assertj-guava 3.27.4.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-guava 3.27.4.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.27.4 from Maven Central.
- Record
RHLW-2026-4688fa8056bb5eb0- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-4b923e6a0c9408d7
Lightwell Security Advisory: assertj-core 3.25.1.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.25.1.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.25.1 from Maven Central.
- Record
RHLW-2026-4b923e6a0c9408d7- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-5c040610f497341f
Lightwell Security Advisory: assertj-core 3.19.0.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.19.0.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.19.0 from Maven Central.
- Record
RHLW-2026-5c040610f497341f- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-621a8fc2f80d3756
Lightwell Security Advisory: assertj-core 3.26.0.rhlw-00004
Red Hat Lightwell has released org.assertj:assertj-core 3.26.0.rhlw-00004 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.26.0 from Maven Central.
- Record
RHLW-2026-621a8fc2f80d3756- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-68f6300fe5cddf04
Lightwell Security Advisory: assertj-core 3.27.6.rhlw-00002
Red Hat Lightwell has released org.assertj:assertj-core 3.27.6.rhlw-00002 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.27.6 from Maven Central.
- Record
RHLW-2026-68f6300fe5cddf04- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-69e0a9b52c08198f
Lightwell Security Advisory: assertj-core 3.1.0.rhlw-00003
Red Hat Lightwell has released org.assertj:assertj-core 3.1.0.rhlw-00003 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.1.0 from Maven Central.
- Record
RHLW-2026-69e0a9b52c08198f- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-6aaf368527c42953
Lightwell Security Advisory: assertj-guava 3.24.1.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-guava 3.24.1.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.24.1 from Maven Central.
- Record
RHLW-2026-6aaf368527c42953- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-75db1a29fed8473f
Lightwell Security Advisory: assertj-core 3.17.2.rhlw-00002
Red Hat Lightwell has released org.assertj:assertj-core 3.17.2.rhlw-00002 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.17.2 from Maven Central.
- Record
RHLW-2026-75db1a29fed8473f- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-8213cb2f9fa5e4f3
Lightwell Security Advisory: assertj-core 3.17.0.rhlw-00002
Red Hat Lightwell has released org.assertj:assertj-core 3.17.0.rhlw-00002 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.17.0 from Maven Central.
- Record
RHLW-2026-8213cb2f9fa5e4f3- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-8e630efedd4a966b
Lightwell Security Advisory: assertj-core 3.27.0.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.27.0.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.27.0 from Maven Central.
- Record
RHLW-2026-8e630efedd4a966b- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-8ee8407887122c89
Lightwell Security Advisory: assertj-guava 3.27.0.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-guava 3.27.0.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.27.0 from Maven Central.
- Record
RHLW-2026-8ee8407887122c89- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-91aedc27b0276f09
Lightwell Security Advisory: assertj-core 3.25.3.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.25.3.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.25.3 from Maven Central.
- Record
RHLW-2026-91aedc27b0276f09- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-9eb6b9377232bc55
Lightwell Security Advisory: assertj-guava 3.26.0.rhlw-00004
Red Hat Lightwell has released org.assertj:assertj-guava 3.26.0.rhlw-00004 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.26.0 from Maven Central.
- Record
RHLW-2026-9eb6b9377232bc55- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-a5a3e82a382ab25b
Lightwell Security Advisory: assertj-guava 3.24.2.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-guava 3.24.2.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.24.2 from Maven Central.
- Record
RHLW-2026-a5a3e82a382ab25b- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-a8f2feb806a7ec11
Lightwell Security Advisory: assertj-core 3.12.2.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.12.2.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.12.2 from Maven Central.
- Record
RHLW-2026-a8f2feb806a7ec11- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-afaba61eb7f2850c
Lightwell Security Advisory: assertj-guava 3.27.2.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-guava 3.27.2.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.27.2 from Maven Central.
- Record
RHLW-2026-afaba61eb7f2850c- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-afdab2228d9d349b
Lightwell Security Advisory: assertj-core 2.9.0.rhlw-00002
Red Hat Lightwell has released org.assertj:assertj-core 2.9.0.rhlw-00002 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 2.9.0 from Maven Central.
- Record
RHLW-2026-afdab2228d9d349b- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-b2c0ee9cf7434158
Lightwell Security Advisory: assertj-core 3.24.1.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.24.1.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.24.1 from Maven Central.
- Record
RHLW-2026-b2c0ee9cf7434158- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-b7941f01d48eb65e
Lightwell Security Advisory: assertj-core 3.25.0.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.25.0.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.25.0 from Maven Central.
- Record
RHLW-2026-b7941f01d48eb65e- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVRHLW-2026-beb8398e1777d04e
Lightwell Security Advisory: assertj-guava 3.27.3.rhlw-00002
Red Hat Lightwell has released org.assertj:assertj-guava 3.27.3.rhlw-00002 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.27.3 from Maven Central.
- Record
RHLW-2026-beb8398e1777d04e- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-bfccea342dd4b844
Lightwell Security Advisory: assertj-core 3.23.1.rhlw-00002
Red Hat Lightwell has released org.assertj:assertj-core 3.23.1.rhlw-00002 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.23.1 from Maven Central.
- Record
RHLW-2026-bfccea342dd4b844- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-c0819a53dd258db2
Lightwell Security Advisory: assertj-core 2.6.0.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 2.6.0.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 2.6.0 from Maven Central.
- Record
RHLW-2026-c0819a53dd258db2- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-c47eb74b897b797c
Lightwell Security Advisory: assertj-core 3.27.5.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.27.5.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.27.5 from Maven Central.
- Record
RHLW-2026-c47eb74b897b797c- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-c53452d5f25a2707
Lightwell Security Advisory: assertj-guava 3.25.0.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-guava 3.25.0.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.25.0 from Maven Central.
- Record
RHLW-2026-c53452d5f25a2707- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-ced7f507fae93c0b
Lightwell Security Advisory: assertj-core 3.5.2.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.5.2.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.5.2 from Maven Central.
- Record
RHLW-2026-ced7f507fae93c0b- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-d0894948a3363188
Lightwell Security Advisory: assertj-core 3.26.3.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.26.3.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.26.3 from Maven Central.
- Record
RHLW-2026-d0894948a3363188- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-d16850b6ed26ed8a
Lightwell Security Advisory: assertj-core 3.27.2.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.27.2.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.27.2 from Maven Central.
- Record
RHLW-2026-d16850b6ed26ed8a- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-d8b82278a734aa57
Lightwell Security Advisory: assertj-core 2.5.0.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 2.5.0.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 2.5.0 from Maven Central.
- Record
RHLW-2026-d8b82278a734aa57- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-e6ec7dddaa32b002
Lightwell Security Advisory: assertj-core 3.24.2.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.24.2.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.24.2 from Maven Central.
- Record
RHLW-2026-e6ec7dddaa32b002- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-e9a6a9ae2da7f754
Lightwell Security Advisory: assertj-guava 3.27.6.rhlw-00002
Red Hat Lightwell has released org.assertj:assertj-guava 3.27.6.rhlw-00002 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.27.6 from Maven Central.
- Record
RHLW-2026-e9a6a9ae2da7f754- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-edfb54be5079ebb7
Lightwell Security Advisory: assertj-guava 3.25.3.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-guava 3.25.3.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.25.3 from Maven Central.
- Record
RHLW-2026-edfb54be5079ebb7- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-edffb5d3bb599ff9
Lightwell Security Advisory: assertj-core 3.27.3.rhlw-00002
Red Hat Lightwell has released org.assertj:assertj-core 3.27.3.rhlw-00002 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.27.3 from Maven Central.
- Record
RHLW-2026-edffb5d3bb599ff9- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-f06e820781099ad6
Lightwell Security Advisory: assertj-core 3.27.4.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.27.4.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.27.4 from Maven Central.
- Record
RHLW-2026-f06e820781099ad6- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-f4501c345c2f2e8b
Lightwell Security Advisory: assertj-core 3.17.1.rhlw-00003
Red Hat Lightwell has released org.assertj:assertj-core 3.17.1.rhlw-00003 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.17.1 from Maven Central.
- Record
RHLW-2026-f4501c345c2f2e8b- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-f5cfa6309ad4f62e
Lightwell Security Advisory: assertj-core 3.6.1.rhlw-00001
Red Hat Lightwell has released org.assertj:assertj-core 3.6.1.rhlw-00001 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.6.1 from Maven Central.
- Record
RHLW-2026-f5cfa6309ad4f62e- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N - Updated
- 2026-11-02
OSVRHSA-2026:58949
Red Hat Security Advisory: assertj-core security update
- Record
RHSA-2026:58949- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L - Updated
- 2026-11-02
OSVRHSA-2026:58956
Red Hat Security Advisory: assertj-core security update
- Record
RHSA-2026:58956- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L - Updated
- 2026-11-02
OSVRHSA-2026:58957
Red Hat Security Advisory: assertj-core security update
- Record
RHSA-2026:58957- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.assertj:assertj-coreMaven |
1.4.0 to 3.27.6 | 3.27.7 |
assertj-coreAlmaLinux:10 |
before 3.24.2-9.el10_2.1 | 3.24.2-9.el10_2.1 |
assertj-core-javadocAlmaLinux:10 |
before 3.24.2-9.el10_2.1 | 3.24.2-9.el10_2.1 |
assertj-coreAlmaLinux:9 |
before 3.19.0-9.el9_8.1 | 3.19.0-9.el9_8.1 |
javapackages-bootstrapAzure Linux:3 |
before 1.14.0-4 | 1.14.0-4 |
org.assertj:assertj-coreTuxCare:Maven |
3.18.1 up to 3.18.1-tuxcare.1 | 3.18.1-tuxcare.1 |
org.assertj:assertj-coreTuxCare:Maven |
2.9.0 up to 2.9.0-tuxcare.1 | 2.9.0-tuxcare.1 |
org.xmlunit:xmlunit-assertjTuxCare:Maven |
2.9.1 up to 2.9.1-tuxcare.1, plus listed versions 2.9.1.tuxcare |
2.9.1-tuxcare.1 |
org.xmlunit:xmlunit-assertj3TuxCare:Maven |
2.9.1 up to 2.9.1-tuxcare.1, plus listed versions 2.9.1.tuxcare |
2.9.1-tuxcare.1 |
org.assertj:assertj-coreTuxCare:Maven |
3.25.3 up to 3.25.3-tuxcare.1 | 3.25.3-tuxcare.1 |
Show 83 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.assertj:assertj-coreTuxCare:Maven |
3.23.1 up to 3.23.1-tuxcare.1 | 3.23.1-tuxcare.1 |
org.assertj:assertj-coreTuxCare:Maven |
3.19.0 up to 3.19.0-tuxcare.1 | 3.19.0-tuxcare.1 |
org.assertj:assertj-coreTuxCare:Maven |
3.24.2 up to 3.24.2-tuxcare.1 | 3.24.2-tuxcare.1 |
org.assertj:assertj-coreTuxCare:Maven |
3.11.1 up to 3.11.1-tuxcare.1 | 3.11.1-tuxcare.1 |
assertj-coreTuxCare:AlmaLinux:9.6 |
before 3.19.0-9.el9_6.tuxcare.els1 | 3.19.0-9.el9_6.tuxcare.els1 |
assertj-core-javadocTuxCare:AlmaLinux:9.6 |
before 3.19.0-9.el9_6.tuxcare.els1 | 3.19.0-9.el9_6.tuxcare.els1 |
assertj-coreTuxCare:AlmaLinux:9.2 |
before 3.19.0-5.el9_2.tuxcare.els1 | 3.19.0-5.el9_2.tuxcare.els1 |
assertj-core-javadocTuxCare:AlmaLinux:9.2 |
before 3.19.0-5.el9_2.tuxcare.els1 | 3.19.0-5.el9_2.tuxcare.els1 |
org.assertj:assertj-coreTuxCare:Maven |
3.22.0 up to 3.22.0-tuxcare.1 | 3.22.0-tuxcare.1 |
org.assertj:assertj-coreTuxCare:Maven |
3.16.1 up to 3.16.1-tuxcare.1 | 3.16.1-tuxcare.1 |
assertj-coreDebian:12 |
All versions, plus listed versions 3.14.0-23.26.3-13.26.3-2 |
None known |
assertj-coreDebian:13 |
All versions, plus listed versions 3.26.3-2 |
None known |
assertj-coreDebian:14 |
All versions, plus listed versions 3.26.3-2 |
None known |
org.assertj:assertj-coreMaven |
1.4.0 up to 3.27.7, plus listed versions 1.5.01.6.01.6.11.7.01.7.1 Show 45 moreShow less2.0.02.1.02.2.02.3.02.4.02.4.12.5.02.6.02.7.02.8.02.9.02.9.13.0.03.1.03.10.03.11.03.11.13.12.03.12.13.12.23.13.03.13.13.13.23.14.03.15.03.16.03.16.13.17.03.17.13.17.23.18.03.18.13.19.03.2.03.20.03.20.13.20.23.21.03.22.03.23.03.23.13.24.03.24.13.24.23.25.0 |
3.27.7 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.16.0 up to 3.16.0.rhlw-00004 | 3.16.0.rhlw-00004 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.4.1 up to 3.4.1.rhlw-00002 | 3.4.1.rhlw-00002 |
org.assertj:assertj-guavaRed Hat Lightwell:Maven |
3.25.1 up to 3.25.1.rhlw-00001 | 3.25.1.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.14.0 up to 3.14.0.rhlw-00001 | 3.14.0.rhlw-00001 |
org.assertj:assertj-guavaRed Hat Lightwell:Maven |
3.26.3 up to 3.26.3.rhlw-00001 | 3.26.3.rhlw-00001 |
org.assertj:assertj-guavaRed Hat Lightwell:Maven |
3.27.5 up to 3.27.5.rhlw-00001 | 3.27.5.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.18.1 up to 3.18.1.rhlw-00003 | 3.18.1.rhlw-00003 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.22.0 up to 3.22.0.rhlw-00001 | 3.22.0.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.9.1 up to 3.9.1.rhlw-00005 | 3.9.1.rhlw-00005 |
org.assertj:assertj-guavaRed Hat Lightwell:Maven |
3.27.4 up to 3.27.4.rhlw-00001 | 3.27.4.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.25.1 up to 3.25.1.rhlw-00001 | 3.25.1.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.19.0 up to 3.19.0.rhlw-00001 | 3.19.0.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.26.0 up to 3.26.0.rhlw-00004 | 3.26.0.rhlw-00004 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.27.6 up to 3.27.6.rhlw-00002 | 3.27.6.rhlw-00002 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.1.0 up to 3.1.0.rhlw-00003 | 3.1.0.rhlw-00003 |
org.assertj:assertj-guavaRed Hat Lightwell:Maven |
before 3.24.1.rhlw-00001, plus listed versions 1.0.01.1.01.2.01.3.01.3.1 Show 11 moreShow less2.0.02.0.13.0.03.1.03.2.03.2.13.24.03.24.13.3.03.4.03.5.0 |
3.24.1.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.17.2 up to 3.17.2.rhlw-00002 | 3.17.2.rhlw-00002 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.17.0 up to 3.17.0.rhlw-00002 | 3.17.0.rhlw-00002 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.27.0 up to 3.27.0.rhlw-00001 | 3.27.0.rhlw-00001 |
org.assertj:assertj-guavaRed Hat Lightwell:Maven |
3.27.0 up to 3.27.0.rhlw-00001 | 3.27.0.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.25.3 up to 3.25.3.rhlw-00001 | 3.25.3.rhlw-00001 |
org.assertj:assertj-guavaRed Hat Lightwell:Maven |
3.26.0 up to 3.26.0.rhlw-00004 | 3.26.0.rhlw-00004 |
org.assertj:assertj-guavaRed Hat Lightwell:Maven |
3.24.2 up to 3.24.2.rhlw-00001 | 3.24.2.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.12.2 up to 3.12.2.rhlw-00001 | 3.12.2.rhlw-00001 |
org.assertj:assertj-guavaRed Hat Lightwell:Maven |
3.27.2 up to 3.27.2.rhlw-00001 | 3.27.2.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
2.9.0 up to 2.9.0.rhlw-00002 | 2.9.0.rhlw-00002 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.24.1 up to 3.24.1.rhlw-00001 | 3.24.1.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.25.0 up to 3.25.0.rhlw-00001 | 3.25.0.rhlw-00001 |
org.assertj:assertj-guavaRed Hat Lightwell:Maven |
3.27.3 up to 3.27.3.rhlw-00002 | 3.27.3.rhlw-00002 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.23.1 up to 3.23.1.rhlw-00002 | 3.23.1.rhlw-00002 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
2.6.0 up to 2.6.0.rhlw-00001 | 2.6.0.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.27.5 up to 3.27.5.rhlw-00001 | 3.27.5.rhlw-00001 |
org.assertj:assertj-guavaRed Hat Lightwell:Maven |
3.25.0 up to 3.25.0.rhlw-00001 | 3.25.0.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.5.2 up to 3.5.2.rhlw-00001 | 3.5.2.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.26.3 up to 3.26.3.rhlw-00001 | 3.26.3.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.27.2 up to 3.27.2.rhlw-00001 | 3.27.2.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
before 2.5.0.rhlw-00001, plus listed versions 1.0.01.1.01.2.01.3.01.4.0 Show 12 moreShow less1.5.01.6.01.6.11.7.01.7.12.0.02.1.02.2.02.3.02.4.02.4.12.5.0 |
2.5.0.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.24.2 up to 3.24.2.rhlw-00001 | 3.24.2.rhlw-00001 |
org.assertj:assertj-guavaRed Hat Lightwell:Maven |
3.27.6 up to 3.27.6.rhlw-00002 | 3.27.6.rhlw-00002 |
org.assertj:assertj-guavaRed Hat Lightwell:Maven |
3.25.3 up to 3.25.3.rhlw-00001 | 3.25.3.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.27.3 up to 3.27.3.rhlw-00002 | 3.27.3.rhlw-00002 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.27.4 up to 3.27.4.rhlw-00001 | 3.27.4.rhlw-00001 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.17.1 up to 3.17.1.rhlw-00003 | 3.17.1.rhlw-00003 |
org.assertj:assertj-coreRed Hat Lightwell:Maven |
3.6.1 up to 3.6.1.rhlw-00001 | 3.6.1.rhlw-00001 |
assertj-coreRed Hat:rhel_eus:9.6::appstream |
before 0:3.19.0-9.el9_6.1 | 0:3.19.0-9.el9_6.1 |
assertj-coreRed Hat:rhel_e4s:9.2::appstream |
before 0:3.19.0-5.el9_2.2 | 0:3.19.0-5.el9_2.2 |
assertj-coreRed Hat:rhel_e4s:9.4::appstream |
before 0:3.19.0-5.el9_4.2 | 0:3.19.0-5.el9_4.2 |
assertj-coreRed Hat:enterprise_linux:10.2 |
before 0:3.24.2-9.el10_2.1 | 0:3.24.2-9.el10_2.1 |
assertj-core-javadocRed Hat:enterprise_linux:10.2 |
before 0:3.24.2-9.el10_2.1 | 0:3.24.2-9.el10_2.1 |
assertj-coreRed Hat:enterprise_linux:9::appstream |
before 0:3.19.0-9.el9_8.1 | 0:3.19.0-9.el9_8.1 |
assertj-coreRed Hat:enterprise_linux_eus:10.0 |
before 0:3.24.2-9.el10_0.1 | 0:3.24.2-9.el10_0.1 |
assertj-core-javadocRed Hat:enterprise_linux_eus:10.0 |
before 0:3.24.2-9.el10_0.1 | 0:3.24.2-9.el10_0.1 |
assertj-coreRocky Linux:10 |
before 0:3.24.2-9.el10_2.1 | 0:3.24.2-9.el10_2.1 |
assertj-coreRocky Linux:9 |
before 0:3.19.0-9.el9_8.1 | 0:3.19.0-9.el9_8.1 |
org.assertj:assertj-coreRoot:Maven |
before 3.24.2-aikido.3 | 3.24.2-aikido.33.24.2-aikido.43.26.3-aikido.13.22.0-aikido.1 |
io.root.org.assertj:assertj-coreRoot:Maven |
before 3.24.2-root.io.1 | 3.24.2-root.io.13.24.2-root.io.23.24.2-root.io.33.24.2-root.io.43.26.3-root.io.13.22.0-root.io.1 |
assertj-coreopenSUSE:Leap 15.6 |
before 3.27.7-150200.5.9.2 | 3.27.7-150200.5.9.2 |
assertj-coreSUSE:Linux Enterprise Server 16.0 |
before 3.27.7-160000.1.1 | 3.27.7-160000.1.1 |
assertj-coreSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 3.27.7-160000.1.1 | 3.27.7-160000.1.1 |
assertj-coreUbuntu:16.04:LTS |
All versions, plus listed versions 2.3.0-1 |
None known |
assertj-coreUbuntu:18.04:LTS |
All versions, plus listed versions 2.3.0-4 |
None known |
assertj-coreUbuntu:20.04:LTS |
All versions, plus listed versions 2.3.0-4 |
None known |
assertj-coreUbuntu:22.04:LTS |
All versions, plus listed versions 2.3.0-4 |
None known |
assertj-coreUbuntu:24.04:LTS |
All versions, plus listed versions 3.14.0-2 |
None known |
assertj-coreUbuntu:25.10 |
All versions, plus listed versions 3.26.3-2 |
None known |
assertj-coreUbuntu:26.10 |
All versions, plus listed versions 3.26.3-2build1 |
None known |
assertj-coreUbuntu:26.04:LTS |
All versions, plus listed versions 3.26.3-23.26.3-2build1 |
None known |
assertj-coreopenSUSE:Tumbleweed |
before 3.27.7-1.1 | 3.27.7-1.1 |
assertj-coreopenSUSE:Leap 16.0 |
before 3.27.7-160000.1.1 | 3.27.7-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-24400 is a high vulnerability (CVSS 8.2) in Assertj, published January 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in org.assertj:assertj-core 3.27.7.
References
github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9r
cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
nvd.nist.gov/vuln/detail/CVE-2026-24400
Show 31 moreShow less
access.redhat.com/errata/RHSA-2026:59372
bugzilla.redhat.com/2433116
errata.almalinux.org/10/ALSA-2026-59372.html
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1788370561.html
security-tracker.debian.org/tracker/CVE-2026-24400
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58949.json
cve.org/CVERecord?id=CVE-2026-24400
errata.rockylinux.org/RLSA-2026:59372
suse.com/support/update/announcement/2026/suse-su-20260344-1
bugzilla.suse.com/1257293
ubuntu.com/security/CVE-2026-24400
Left out here: 25 versions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 28 source records.