CVE-2026-24400
1 advisory.
Maven/org.assertj:assertj-core CVE-2026-24400: high
AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
Action: Upgrade org.assertj:assertj-core to 3.27.7 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.4.0 | 3.27.7 | - |
Fixed versions
| 3.27.7 |
Sources
- osv: GHSA-rqfh-9r24-8c9r
- https://github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9r
- https://nvd.nist.gov/vuln/detail/CVE-2026-24400
- https://github.com/assertj/assertj/commit/85ca7eb6609bb179c043b85ae7d290523b1ba79a
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
- https://github.com/assertj/assertj
- https://github.com/assertj/assertj/releases/tag/assertj-build-3.27.7
CVE-2026-24400 · published · modified · JSON