{"id":"CVE-2026-24400","aliases":["ALSA-2026:59372","ALSA-2026:60215","AZL-75431","CLSA-2026-1778028242","CLSA-2026-1783558957","CLSA-2026-1783904622","CLSA-2026-1783991040","CLSA-2026-1784077508","CLSA-2026-1784682842","CLSA-2026-1784682843","CLSA-2026-1784682933","CLSA-2026-1785727930","CLSA-2026-1788370561","CLSA-2026-1788766641","CLSA-2026-1788881384","CLSA-2026-1793128109","CLSA-2026-1793727964","DEBIAN-CVE-2026-24400","EUVD-2026-4724","GHSA-rqfh-9r24-8c9r","RHLW-2026-04395e330cc28cb3","RHLW-2026-06c890c70b401b52","RHLW-2026-0a09f6ecf7835ea0","RHLW-2026-125c08589a792d0c","RHLW-2026-1dfa725faa28bd98","RHLW-2026-2f00b906a72c7d80","RHLW-2026-3c10659b7340e612","RHLW-2026-3f93bdcc94a21f2e","RHLW-2026-44bcd6e79804e6f9","RHLW-2026-4688fa8056bb5eb0","RHLW-2026-4b923e6a0c9408d7","RHLW-2026-5c040610f497341f","RHLW-2026-621a8fc2f80d3756","RHLW-2026-68f6300fe5cddf04","RHLW-2026-69e0a9b52c08198f","RHLW-2026-6aaf368527c42953","RHLW-2026-75db1a29fed8473f","RHLW-2026-8213cb2f9fa5e4f3","RHLW-2026-8e630efedd4a966b","RHLW-2026-8ee8407887122c89","RHLW-2026-91aedc27b0276f09","RHLW-2026-9eb6b9377232bc55","RHLW-2026-a5a3e82a382ab25b","RHLW-2026-a8f2feb806a7ec11","RHLW-2026-afaba61eb7f2850c","RHLW-2026-afdab2228d9d349b","RHLW-2026-b2c0ee9cf7434158","RHLW-2026-b7941f01d48eb65e","RHLW-2026-beb8398e1777d04e","RHLW-2026-bfccea342dd4b844","RHLW-2026-c0819a53dd258db2","RHLW-2026-c47eb74b897b797c","RHLW-2026-c53452d5f25a2707","RHLW-2026-ced7f507fae93c0b","RHLW-2026-d0894948a3363188","RHLW-2026-d16850b6ed26ed8a","RHLW-2026-d8b82278a734aa57","RHLW-2026-e6ec7dddaa32b002","RHLW-2026-e9a6a9ae2da7f754","RHLW-2026-edfb54be5079ebb7","RHLW-2026-edffb5d3bb599ff9","RHLW-2026-f06e820781099ad6","RHLW-2026-f4501c345c2f2e8b","RHLW-2026-f5cfa6309ad4f62e","RHSA-2026:58949","RHSA-2026:58956","RHSA-2026:58957","RHSA-2026:59372","RHSA-2026:60215","RHSA-2026:69106","RLSA-2026:59372","RLSA-2026:60215","ROOT-APP-MAVEN-CVE-2026-24400","SUSE-SU-2026:0344-1","SUSE-SU-2026:20604-1","UBUNTU-CVE-2026-24400","openSUSE-SU-2026:10106-1","openSUSE-SU-2026:20298-1"],"status":"published","title":"AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion","description":"AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via \"Billion Laughs\" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00568,"percentile":0.47584,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2026-01-26T21:31:41Z","modified":"2026-11-04T02:30:02Z","fixes":[{"ecosystem":"Maven","package":"org.assertj:assertj-core","fixed_in":["3.27.7"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:10","package":"assertj-core","fixed_in":["3.24.2-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"assertj-core-javadoc","fixed_in":["3.24.2-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"assertj-core","fixed_in":["3.19.0-9.el9_8.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"javapackages-bootstrap","fixed_in":["1.14.0-4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.assertj:assertj-core","fixed_in":["3.18.1-tuxcare.1","2.9.0-tuxcare.1","3.25.3-tuxcare.1","3.23.1-tuxcare.1","3.19.0-tuxcare.1","3.24.2-tuxcare.1","3.11.1-tuxcare.1","3.22.0-tuxcare.1","3.16.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.xmlunit:xmlunit-assertj","fixed_in":["2.9.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.xmlunit:xmlunit-assertj3","fixed_in":["2.9.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"assertj-core","fixed_in":["3.19.0-9.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"assertj-core-javadoc","fixed_in":["3.19.0-9.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"assertj-core","fixed_in":["3.19.0-5.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"assertj-core-javadoc","fixed_in":["3.19.0-5.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","fixed_in":["3.16.0.rhlw-00004","3.4.1.rhlw-00002","3.14.0.rhlw-00001","3.18.1.rhlw-00003","3.22.0.rhlw-00001","3.9.1.rhlw-00005","3.25.1.rhlw-00001","3.19.0.rhlw-00001","3.26.0.rhlw-00004","3.27.6.rhlw-00002","3.1.0.rhlw-00003","3.17.2.rhlw-00002","3.17.0.rhlw-00002","3.27.0.rhlw-00001","3.25.3.rhlw-00001","3.12.2.rhlw-00001","2.9.0.rhlw-00002","3.24.1.rhlw-00001","3.25.0.rhlw-00001","3.23.1.rhlw-00002","2.6.0.rhlw-00001","3.27.5.rhlw-00001","3.5.2.rhlw-00001","3.26.3.rhlw-00001","3.27.2.rhlw-00001","2.5.0.rhlw-00001","3.24.2.rhlw-00001","3.27.3.rhlw-00002","3.27.4.rhlw-00001","3.17.1.rhlw-00003","3.6.1.rhlw-00001"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-guava","fixed_in":["3.25.1.rhlw-00001","3.26.3.rhlw-00001","3.27.5.rhlw-00001","3.27.4.rhlw-00001","3.24.1.rhlw-00001","3.27.0.rhlw-00001","3.26.0.rhlw-00004","3.24.2.rhlw-00001","3.27.2.rhlw-00001","3.27.3.rhlw-00002","3.25.0.rhlw-00001","3.27.6.rhlw-00002","3.25.3.rhlw-00001"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"assertj-core","fixed_in":["0:3.19.0-9.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"assertj-core","fixed_in":["0:3.19.0-5.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"assertj-core","fixed_in":["0:3.19.0-5.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"assertj-core","fixed_in":["0:3.24.2-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"assertj-core-javadoc","fixed_in":["0:3.24.2-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"assertj-core","fixed_in":["0:3.19.0-9.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"assertj-core","fixed_in":["0:3.24.2-9.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"assertj-core-javadoc","fixed_in":["0:3.24.2-9.el10_0.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"assertj-core","fixed_in":["0:3.24.2-9.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"assertj-core","fixed_in":["0:3.19.0-9.el9_8.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.assertj:assertj-core","fixed_in":["3.24.2-aikido.3","3.24.2-aikido.4","3.26.3-aikido.1","3.22.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.assertj:assertj-core","fixed_in":["3.24.2-root.io.1","3.24.2-root.io.2","3.24.2-root.io.3","3.24.2-root.io.4","3.26.3-root.io.1","3.22.0-root.io.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"assertj-core","fixed_in":["3.27.7-150200.5.9.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"assertj-core","fixed_in":["3.27.7-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"assertj-core","fixed_in":["3.27.7-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"assertj-core","fixed_in":["3.27.7-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"assertj-core","fixed_in":["3.27.7-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"last_affected":"3.27.6"},{"fixed":"3.27.7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24.2-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"assertj-core-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24.2-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-9.el9_8.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"javapackages-bootstrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.18.1"},{"fixed":"3.18.1-tuxcare.1"}]}],"versions":["3.18.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.0-tuxcare.1"}]}],"versions":["2.9.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.xmlunit:xmlunit-assertj","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.1"},{"fixed":"2.9.1-tuxcare.1"}]}],"versions":["2.9.1","2.9.1.tuxcare"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.xmlunit:xmlunit-assertj3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.1"},{"fixed":"2.9.1-tuxcare.1"}]}],"versions":["2.9.1","2.9.1.tuxcare"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.25.3"},{"fixed":"3.25.3-tuxcare.1"}]}],"versions":["3.25.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.23.1"},{"fixed":"3.23.1-tuxcare.1"}]}],"versions":["3.23.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.0"},{"fixed":"3.19.0-tuxcare.1"}]}],"versions":["3.19.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.24.2"},{"fixed":"3.24.2-tuxcare.1"}]}],"versions":["3.24.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.1"},{"fixed":"3.11.1-tuxcare.1"}]}],"versions":["3.11.1"]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-9.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"assertj-core-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-9.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-5.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"assertj-core-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-5.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.22.0"},{"fixed":"3.22.0-tuxcare.1"}]}],"versions":["3.22.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.1"},{"fixed":"3.16.1-tuxcare.1"}]}],"versions":["3.16.1"]},{"source":"osv","ecosystem":"Debian:12","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.0-2","3.26.3-1","3.26.3-2"]},{"source":"osv","ecosystem":"Debian:13","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.3-2"]},{"source":"osv","ecosystem":"Debian:14","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.3-2"]},{"source":"osv","ecosystem":"Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"3.27.7"}]}],"versions":["1.4.0","1.5.0","1.6.0","1.6.1","1.7.0","1.7.1","2.0.0","2.1.0","2.2.0","2.3.0","2.4.0","2.4.1","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1","3.0.0","3.1.0","3.10.0","3.11.0","3.11.1","3.12.0","3.12.1","3.12.2","3.13.0","3.13.1","3.13.2","3.14.0","3.15.0","3.16.0","3.16.1","3.17.0","3.17.1","3.17.2","3.18.0","3.18.1","3.19.0","3.2.0","3.20.0","3.20.1","3.20.2","3.21.0","3.22.0","3.23.0","3.23.1","3.24.0","3.24.1","3.24.2","3.25.0","3.25.1","3.25.2","3.25.3","3.26.0","3.26.3","3.27.0","3.27.1","3.27.2","3.27.3","3.27.4","3.27.5","3.27.6","3.3.0","3.4.0","3.4.1","3.5.0","3.5.1","3.5.2","3.6.0","3.6.1","3.6.2","3.7.0","3.8.0","3.9.0","3.9.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.0"},{"fixed":"3.16.0.rhlw-00004"}]}],"versions":["3.16.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1"},{"fixed":"3.4.1.rhlw-00002"}]}],"versions":["3.4.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.25.1"},{"fixed":"3.25.1.rhlw-00001"}]}],"versions":["3.25.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.14.0"},{"fixed":"3.14.0.rhlw-00001"}]}],"versions":["3.14.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.26.3"},{"fixed":"3.26.3.rhlw-00001"}]}],"versions":["3.26.3"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.27.5"},{"fixed":"3.27.5.rhlw-00001"}]}],"versions":["3.27.5"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.18.1"},{"fixed":"3.18.1.rhlw-00003"}]}],"versions":["3.18.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.22.0"},{"fixed":"3.22.0.rhlw-00001"}]}],"versions":["3.22.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.1"},{"fixed":"3.9.1.rhlw-00005"}]}],"versions":["3.9.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.27.4"},{"fixed":"3.27.4.rhlw-00001"}]}],"versions":["3.27.4"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.25.1"},{"fixed":"3.25.1.rhlw-00001"}]}],"versions":["3.25.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.0"},{"fixed":"3.19.0.rhlw-00001"}]}],"versions":["3.19.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.26.0"},{"fixed":"3.26.0.rhlw-00004"}]}],"versions":["3.26.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.27.6"},{"fixed":"3.27.6.rhlw-00002"}]}],"versions":["3.27.6"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.0.rhlw-00003"}]}],"versions":["3.1.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24.1.rhlw-00001"}]}],"versions":["1.0.0","1.1.0","1.2.0","1.3.0","1.3.1","2.0.0","2.0.1","3.0.0","3.1.0","3.2.0","3.2.1","3.24.0","3.24.1","3.3.0","3.4.0","3.5.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.2"},{"fixed":"3.17.2.rhlw-00002"}]}],"versions":["3.17.2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.0"},{"fixed":"3.17.0.rhlw-00002"}]}],"versions":["3.17.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.27.0"},{"fixed":"3.27.0.rhlw-00001"}]}],"versions":["3.27.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.27.0"},{"fixed":"3.27.0.rhlw-00001"}]}],"versions":["3.27.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.25.3"},{"fixed":"3.25.3.rhlw-00001"}]}],"versions":["3.25.3"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.26.0"},{"fixed":"3.26.0.rhlw-00004"}]}],"versions":["3.26.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.24.2"},{"fixed":"3.24.2.rhlw-00001"}]}],"versions":["3.24.2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.2"},{"fixed":"3.12.2.rhlw-00001"}]}],"versions":["3.12.2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.27.2"},{"fixed":"3.27.2.rhlw-00001"}]}],"versions":["3.27.2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.0.rhlw-00002"}]}],"versions":["2.9.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.24.1"},{"fixed":"3.24.1.rhlw-00001"}]}],"versions":["3.24.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.25.0"},{"fixed":"3.25.0.rhlw-00001"}]}],"versions":["3.25.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.27.3"},{"fixed":"3.27.3.rhlw-00002"}]}],"versions":["3.27.3"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.23.1"},{"fixed":"3.23.1.rhlw-00002"}]}],"versions":["3.23.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.0.rhlw-00001"}]}],"versions":["2.6.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.27.5"},{"fixed":"3.27.5.rhlw-00001"}]}],"versions":["3.27.5"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.25.0"},{"fixed":"3.25.0.rhlw-00001"}]}],"versions":["3.25.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.2"},{"fixed":"3.5.2.rhlw-00001"}]}],"versions":["3.5.2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.26.3"},{"fixed":"3.26.3.rhlw-00001"}]}],"versions":["3.26.3"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.27.2"},{"fixed":"3.27.2.rhlw-00001"}]}],"versions":["3.27.2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0.rhlw-00001"}]}],"versions":["1.0.0","1.1.0","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.6.1","1.7.0","1.7.1","2.0.0","2.1.0","2.2.0","2.3.0","2.4.0","2.4.1","2.5.0"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.24.2"},{"fixed":"3.24.2.rhlw-00001"}]}],"versions":["3.24.2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.27.6"},{"fixed":"3.27.6.rhlw-00002"}]}],"versions":["3.27.6"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.25.3"},{"fixed":"3.25.3.rhlw-00001"}]}],"versions":["3.25.3"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.27.3"},{"fixed":"3.27.3.rhlw-00002"}]}],"versions":["3.27.3"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.27.4"},{"fixed":"3.27.4.rhlw-00001"}]}],"versions":["3.27.4"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.1"},{"fixed":"3.17.1.rhlw-00003"}]}],"versions":["3.17.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.1"},{"fixed":"3.6.1.rhlw-00001"}]}],"versions":["3.6.1"]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.0-9.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.0-5.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.0-5.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.24.2-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"assertj-core-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.24.2-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.0-9.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.24.2-9.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"assertj-core-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.24.2-9.el10_0.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.24.2-9.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.0-9.el9_8.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24.2-aikido.3"},{"fixed":"3.24.2-aikido.4"},{"fixed":"3.26.3-aikido.1"},{"fixed":"3.22.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.assertj:assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24.2-root.io.1"},{"fixed":"3.24.2-root.io.2"},{"fixed":"3.24.2-root.io.3"},{"fixed":"3.24.2-root.io.4"},{"fixed":"3.26.3-root.io.1"},{"fixed":"3.22.0-root.io.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.7-150200.5.9.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.7-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.7-160000.1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0-4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0-4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.0-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.3-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.3-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.3-2","3.26.3-2build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.7-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"assertj-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.7-160000.1.1"}]}]}],"products":[{"vendor":"assertj","product":"assertj"}],"references":[{"url":"https://github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9r","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/assertj/assertj/commit/85ca7eb6609bb179c043b85ae7d290523b1ba79a","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html","tags":["x_refsource_MISC","Technical Description","web","article","report"]},{"url":"https://github.com/assertj/assertj/releases/tag/assertj-build-3.27.7","tags":["x_refsource_MISC","Product","Release Notes","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24400","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-rqfh-9r24-8c9r","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59372","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24400","tags":["report"]},{"url":"https://bugzilla.redhat.com/2433116","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-59372.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60215","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-60215.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1788370561.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788881384.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24400.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-24400","tags":["advisory"]},{"url":"https://github.com/assertj/assertj","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58949","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433116","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58949.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24400","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58956","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58956.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58957","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58957.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59372.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60215.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69106","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69106.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:59372","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:60215","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260344-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257293","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24400","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620604-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-24400","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-24400","title":"AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion","description":"AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via \"Billion Laughs\" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.","status":"published","published":"2026-01-26T22:19:02.161Z","modified":"2026-01-27T21:36:26.716Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:19:50.575061Z"}],"euvd":[{"id":"EUVD-2026-4724","description":"AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via \"Billion Laughs\" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.","status":"published","published":"2026-01-26T22:19:02Z","modified":"2026-01-27T21:36:26Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:48:46.818498Z"}],"ghsa":[{"id":"GHSA-rqfh-9r24-8c9r","title":"AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion","description":"An XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values.\n\nAn application is vulnerable only when it uses untrusted XML input with one of the following methods:\n\n- `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert`\n- `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`\n\n### Impact\n\nIf untrusted XML input is processed by the methods mentioned above (e.g., in test environments handling external fixture files), an attacker could:\n\n- **Read arbitrary local files** via `file://` URIs (e.g., `/etc/passwd`, application configuration files)\n- **Perform Server-Side Request Forgery (SSRF)** via HTTP/HTTPS URIs\n- **Cause Denial of Service** via \"Billion Laughs\" entity expansion attacks\n\n### Mitigation\n\n`isXmlEqualTo(CharSequence)` has been deprecated in favor of [XMLUnit](https://www.xmlunit.org/) in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference:\n\n1. Replace `isXmlEqualTo(CharSequence)` with XMLUnit, or\n2. Upgrade to version 3.27.7, or\n3. Avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input.\n\n`XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.\n\n### References\n\n- [CWE-611: Improper Restriction of XML External Entity Reference](https://cwe.mitre.org/data/definitions/611.html)\n- [OWASP XXE Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)","status":"published","published":"2026-01-26T21:31:41Z","modified":"2026-01-29T03:24:22Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:39:20.563096Z"}],"nvd":[{"id":"CVE-2026-24400","description":"AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via \"Billion Laughs\" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.","status":"published","published":"2026-01-26T23:16:08.803Z","modified":"2026-06-17T10:23:00.57Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"CVE-2026-24400","title":"AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion","description":"AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via \"Billion Laughs\" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.","status":"published","published":"2026-01-26T22:19:02.161Z","modified":"2026-10-28T11:10:06.923379263Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:44:59.079784Z"},{"id":"DEBIAN-CVE-2026-24400","description":"AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via \"Billion Laughs\" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.","status":"published","published":"2026-01-26T23:16:08.803Z","modified":"2026-10-01T03:02:33.150358708Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-rqfh-9r24-8c9r","title":"AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion","description":"An XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values.\n\nAn application is vulnerable only when it uses untrusted XML input with one of the following methods:\n\n- `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert`\n- `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`\n\n### Impact\n\nIf untrusted XML input is processed by the methods mentioned above (e.g., in test environments handling external fixture files), an attacker could:\n\n- **Read arbitrary local files** via `file://` URIs (e.g., `/etc/passwd`, application configuration files)\n- **Perform Server-Side Request Forgery (SSRF)** via HTTP/HTTPS URIs\n- **Cause Denial of Service** via \"Billion Laughs\" entity expansion attacks\n\n### Mitigation\n\n`isXmlEqualTo(CharSequence)` has been deprecated in favor of [XMLUnit](https://www.xmlunit.org/) in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference:\n\n1. Replace `isXmlEqualTo(CharSequence)` with XMLUnit, or\n2. Upgrade to version 3.27.7, or\n3. Avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input.\n\n`XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.\n\n### References\n\n- [CWE-611: Improper Restriction of XML External Entity Reference](https://cwe.mitre.org/data/definitions/611.html)\n- [OWASP XXE Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)","status":"published","published":"2026-01-26T21:31:41Z","modified":"2026-02-03T03:04:53.356771Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"RHLW-2026-04395e330cc28cb3","title":"Lightwell Security Advisory: assertj-core 3.16.0.rhlw-00004","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.16.0.rhlw-00004 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.16.0 from Maven Central.","status":"published","published":"2026-09-08T16:03:01Z","modified":"2026-10-29T14:30:07.14077741Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-06c890c70b401b52","title":"Lightwell Security Advisory: assertj-core 3.4.1.rhlw-00002","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.4.1.rhlw-00002 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.4.1 from Maven Central.","status":"published","published":"2026-10-08T19:46:08Z","modified":"2026-10-29T14:30:07.156214881Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-0a09f6ecf7835ea0","title":"Lightwell Security Advisory: assertj-guava 3.25.1.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-guava 3.25.1.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.25.1 from Maven Central.","status":"published","published":"2026-10-08T19:46:12Z","modified":"2026-10-29T14:30:04.594839582Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-125c08589a792d0c","title":"Lightwell Security Advisory: assertj-core 3.14.0.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.14.0.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.14.0 from Maven Central.","status":"published","published":"2026-10-08T19:46:06Z","modified":"2026-10-29T14:30:04.373091798Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-1dfa725faa28bd98","title":"Lightwell Security Advisory: assertj-guava 3.26.3.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-guava 3.26.3.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.26.3 from Maven Central.","status":"published","published":"2026-10-08T19:46:14Z","modified":"2026-10-29T14:30:03.372671613Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-2f00b906a72c7d80","title":"Lightwell Security Advisory: assertj-guava 3.27.5.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-guava 3.27.5.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.27.5 from Maven Central.","status":"published","published":"2026-10-08T19:46:18Z","modified":"2026-10-29T14:30:07.124564902Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-3c10659b7340e612","title":"Lightwell Security Advisory: assertj-core 3.18.1.rhlw-00003","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.18.1.rhlw-00003 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.18.1 from Maven Central.","status":"published","published":"2026-10-22T10:07:34Z","modified":"2026-10-29T14:30:06.331239435Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-3f93bdcc94a21f2e","title":"Lightwell Security Advisory: assertj-core 3.22.0.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.22.0.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.22.0 from Maven Central.","status":"published","published":"2026-10-08T19:46:07Z","modified":"2026-10-29T14:30:03.534008339Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-44bcd6e79804e6f9","title":"Lightwell Security Advisory: assertj-core 3.9.1.rhlw-00005","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.9.1.rhlw-00005 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.9.1 from Maven Central.","status":"published","published":"2026-09-08T10:27:30Z","modified":"2026-10-29T14:30:05.060988438Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-4688fa8056bb5eb0","title":"Lightwell Security Advisory: assertj-guava 3.27.4.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-guava 3.27.4.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.27.4 from Maven Central.","status":"published","published":"2026-10-08T19:46:17Z","modified":"2026-10-29T14:30:04.662365489Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-4b923e6a0c9408d7","title":"Lightwell Security Advisory: assertj-core 3.25.1.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.25.1.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.25.1 from Maven Central.","status":"published","published":"2026-10-12T19:50:23Z","modified":"2026-10-29T14:30:05.584043179Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-5c040610f497341f","title":"Lightwell Security Advisory: assertj-core 3.19.0.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.19.0.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.19.0 from Maven Central.","status":"published","published":"2026-10-12T16:58:57Z","modified":"2026-10-29T14:30:06.056919419Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-621a8fc2f80d3756","title":"Lightwell Security Advisory: assertj-core 3.26.0.rhlw-00004","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.26.0.rhlw-00004 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.26.0 from Maven Central.","status":"published","published":"2026-09-08T13:45:26Z","modified":"2026-10-29T14:30:03.419639097Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-68f6300fe5cddf04","title":"Lightwell Security Advisory: assertj-core 3.27.6.rhlw-00002","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.27.6.rhlw-00002 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.27.6 from Maven Central.","status":"published","published":"2026-10-12T19:51:15Z","modified":"2026-10-29T14:30:05.052901166Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-69e0a9b52c08198f","title":"Lightwell Security Advisory: assertj-core 3.1.0.rhlw-00003","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.1.0.rhlw-00003 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.1.0 from Maven Central.","status":"published","published":"2026-10-08T19:46:05Z","modified":"2026-10-29T14:30:05.358342514Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-6aaf368527c42953","title":"Lightwell Security Advisory: assertj-guava 3.24.1.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-guava 3.24.1.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.24.1 from Maven Central.","status":"published","published":"2026-10-08T19:46:10Z","modified":"2026-10-27T04:00:10.732637515Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-75db1a29fed8473f","title":"Lightwell Security Advisory: assertj-core 3.17.2.rhlw-00002","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.17.2.rhlw-00002 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.17.2 from Maven Central.","status":"published","published":"2026-09-09T12:08:10Z","modified":"2026-10-29T14:30:03.564599243Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-8213cb2f9fa5e4f3","title":"Lightwell Security Advisory: assertj-core 3.17.0.rhlw-00002","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.17.0.rhlw-00002 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.17.0 from Maven Central.","status":"published","published":"2026-09-08T09:32:51Z","modified":"2026-10-29T14:30:05.051871696Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-8e630efedd4a966b","title":"Lightwell Security Advisory: assertj-core 3.27.0.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.27.0.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.27.0 from Maven Central.","status":"published","published":"2026-10-12T19:51:56Z","modified":"2026-10-29T14:30:05.141438308Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-8ee8407887122c89","title":"Lightwell Security Advisory: assertj-guava 3.27.0.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-guava 3.27.0.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.27.0 from Maven Central.","status":"published","published":"2026-10-08T19:46:15Z","modified":"2026-10-29T14:30:06.068779202Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-91aedc27b0276f09","title":"Lightwell Security Advisory: assertj-core 3.25.3.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.25.3.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.25.3 from Maven Central.","status":"published","published":"2026-10-12T19:52:08Z","modified":"2026-10-29T14:30:06.071690892Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-9eb6b9377232bc55","title":"Lightwell Security Advisory: assertj-guava 3.26.0.rhlw-00004","description":"Red Hat Lightwell has released org.assertj:assertj-guava 3.26.0.rhlw-00004 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.26.0 from Maven Central.","status":"published","published":"2026-10-08T19:46:14Z","modified":"2026-10-29T14:30:07.170022972Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-a5a3e82a382ab25b","title":"Lightwell Security Advisory: assertj-guava 3.24.2.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-guava 3.24.2.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.24.2 from Maven Central.","status":"published","published":"2026-10-08T19:46:11Z","modified":"2026-10-29T14:30:03.558033243Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-a8f2feb806a7ec11","title":"Lightwell Security Advisory: assertj-core 3.12.2.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.12.2.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.12.2 from Maven Central.","status":"published","published":"2026-10-08T19:46:05Z","modified":"2026-10-29T14:30:06.065068805Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-afaba61eb7f2850c","title":"Lightwell Security Advisory: assertj-guava 3.27.2.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-guava 3.27.2.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.27.2 from Maven Central.","status":"published","published":"2026-10-08T19:46:16Z","modified":"2026-10-29T14:30:09.035648688Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-afdab2228d9d349b","title":"Lightwell Security Advisory: assertj-core 2.9.0.rhlw-00002","description":"Red Hat Lightwell has released org.assertj:assertj-core 2.9.0.rhlw-00002 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 2.9.0 from Maven Central.","status":"published","published":"2026-09-08T13:56:39Z","modified":"2026-10-29T14:30:11.459928274Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-b2c0ee9cf7434158","title":"Lightwell Security Advisory: assertj-core 3.24.1.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.24.1.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.24.1 from Maven Central.","status":"published","published":"2026-10-12T19:53:11Z","modified":"2026-10-29T14:30:09.433889012Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-b7941f01d48eb65e","title":"Lightwell Security Advisory: assertj-core 3.25.0.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.25.0.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.25.0 from Maven Central.","status":"published","published":"2026-10-12T19:53:12Z","modified":"2026-10-29T14:30:10.569053822Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-beb8398e1777d04e","title":"Lightwell Security Advisory: assertj-guava 3.27.3.rhlw-00002","description":"Red Hat Lightwell has released org.assertj:assertj-guava 3.27.3.rhlw-00002 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.27.3 from Maven Central.","status":"published","published":"2026-10-08T19:46:17Z","modified":"2026-10-29T14:30:10.591706641Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-bfccea342dd4b844","title":"Lightwell Security Advisory: assertj-core 3.23.1.rhlw-00002","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.23.1.rhlw-00002 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.23.1 from Maven Central.","status":"published","published":"2026-10-08T19:46:08Z","modified":"2026-10-29T14:30:10.942051758Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-c0819a53dd258db2","title":"Lightwell Security Advisory: assertj-core 2.6.0.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 2.6.0.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 2.6.0 from Maven Central.","status":"published","published":"2026-10-08T19:46:04Z","modified":"2026-10-29T14:30:11.668516694Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-c47eb74b897b797c","title":"Lightwell Security Advisory: assertj-core 3.27.5.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.27.5.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.27.5 from Maven Central.","status":"published","published":"2026-10-12T19:53:16Z","modified":"2026-10-29T14:30:02.410227871Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-c53452d5f25a2707","title":"Lightwell Security Advisory: assertj-guava 3.25.0.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-guava 3.25.0.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.25.0 from Maven Central.","status":"published","published":"2026-10-08T19:46:12Z","modified":"2026-10-29T14:30:02.413437343Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-ced7f507fae93c0b","title":"Lightwell Security Advisory: assertj-core 3.5.2.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.5.2.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.5.2 from Maven Central.","status":"published","published":"2026-10-08T19:46:09Z","modified":"2026-10-29T14:30:02.409041657Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-d0894948a3363188","title":"Lightwell Security Advisory: assertj-core 3.26.3.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.26.3.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.26.3 from Maven Central.","status":"published","published":"2026-10-12T19:53:21Z","modified":"2026-10-29T14:30:11.445329935Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-d16850b6ed26ed8a","title":"Lightwell Security Advisory: assertj-core 3.27.2.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.27.2.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.27.2 from Maven Central.","status":"published","published":"2026-10-12T19:53:22Z","modified":"2026-10-29T14:30:11.041284009Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-d8b82278a734aa57","title":"Lightwell Security Advisory: assertj-core 2.5.0.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 2.5.0.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 2.5.0 from Maven Central.","status":"published","published":"2026-10-08T19:46:03Z","modified":"2026-10-27T04:00:17.842675961Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-e6ec7dddaa32b002","title":"Lightwell Security Advisory: assertj-core 3.24.2.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.24.2.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.24.2 from Maven Central.","status":"published","published":"2026-09-08T15:29:18Z","modified":"2026-10-29T14:30:02.408076456Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"RHLW-2026-e9a6a9ae2da7f754","title":"Lightwell Security Advisory: assertj-guava 3.27.6.rhlw-00002","description":"Red Hat Lightwell has released org.assertj:assertj-guava 3.27.6.rhlw-00002 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.27.6 from Maven Central.","status":"published","published":"2026-10-08T19:46:19Z","modified":"2026-10-29T14:30:02.405158077Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"RHLW-2026-edfb54be5079ebb7","title":"Lightwell Security Advisory: assertj-guava 3.25.3.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-guava 3.25.3.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-guava 3.25.3 from Maven Central.","status":"published","published":"2026-10-08T19:46:13Z","modified":"2026-10-29T14:30:11.06215635Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"RHLW-2026-edffb5d3bb599ff9","title":"Lightwell Security Advisory: assertj-core 3.27.3.rhlw-00002","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.27.3.rhlw-00002 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.27.3 from Maven Central.","status":"published","published":"2026-10-12T19:53:26Z","modified":"2026-10-29T14:30:11.442110194Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"RHLW-2026-f06e820781099ad6","title":"Lightwell Security Advisory: assertj-core 3.27.4.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.27.4.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.27.4 from Maven Central.","status":"published","published":"2026-10-12T19:53:31Z","modified":"2026-10-29T14:30:10.117234212Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"RHLW-2026-f4501c345c2f2e8b","title":"Lightwell Security Advisory: assertj-core 3.17.1.rhlw-00003","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.17.1.rhlw-00003 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.17.1 from Maven Central.","status":"published","published":"2026-09-09T11:54:30Z","modified":"2026-10-29T14:30:10.647403111Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"RHLW-2026-f5cfa6309ad4f62e","title":"Lightwell Security Advisory: assertj-core 3.6.1.rhlw-00001","description":"Red Hat Lightwell has released org.assertj:assertj-core 3.6.1.rhlw-00001 with a backported security fix.\n\nCVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion\n\nThis patched artifact is a drop-in replacement for org.assertj:assertj-core 3.6.1 from Maven Central.","status":"published","published":"2026-10-08T19:46:10Z","modified":"2026-10-29T14:30:10.653594182Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"RHSA-2026:58949","title":"Red Hat Security Advisory: assertj-core security update","status":"published","published":"2026-08-25T10:23:02Z","modified":"2026-10-15T10:22:13Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:58956","title":"Red Hat Security Advisory: assertj-core security update","status":"published","published":"2026-08-25T10:23:04Z","modified":"2026-10-15T10:22:14Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:58957","title":"Red Hat Security Advisory: assertj-core security update","status":"published","published":"2026-08-25T10:23:05Z","modified":"2026-10-15T10:22:15Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"}]},"sources_more":{"osv":28}}