Skip to content
OpenAdvisories
High RHSA-2026:58949 1 CVE

Red Hat Security Advisory: assertj-core security update

Published Aug 25, 2026 · Updated Oct 15, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream assertj-core 0:3.19.0-9.el9_6.1

Vulnerabilities 1

  • High 8.2
    CVE-2026-24400

    AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion

    AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXm…

    assertj assertj javapackages-bootstrap assertj-core Debian Ubuntu Azure Linux Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2433116
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58949.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-24400
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-24400
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-24400
  • article
    https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
  • article
    https://github.com/assertj/assertj/commit/85ca7eb6609bb179c043b85ae7d290523b1ba79a
  • article
    https://github.com/assertj/assertj/releases/tag/assertj-build-3.27.7
  • article
    https://github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9r