Skip to content
OpenAdvisories
High RHSA-2026:59372 1 CVE

Red Hat Security Advisory: assertj-core security update

Published Aug 26, 2026 · Updated Oct 15, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 assertj-core 0:3.24.2-9.el10_2.1
Red Hat · RHEL 10 enterprise_linux:10.2 assertj-core-javadoc 0:3.24.2-9.el10_2.1

Vulnerabilities 1

  • High 8.2
    CVE-2026-24400

    AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion

    AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXm…

    assertj assertj javapackages-bootstrap assertj-core Debian Ubuntu Azure Linux Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2433116
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59372.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-24400
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-24400
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-24400
  • article
    https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
  • article
    https://github.com/assertj/assertj/commit/85ca7eb6609bb179c043b85ae7d290523b1ba79a
  • article
    https://github.com/assertj/assertj/releases/tag/assertj-build-3.27.7
  • article
    https://github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9r