Skip to main content

Assertj CVE-2026-24400

CRITICAL
Improper Restriction of XML External Entity Reference (CWE-611)
2026-01-26 security-advisories@github.com GHSA-rqfh-9r24-8c9r
Denial Of Service Java SSRF XXE Red Hat Assertj Suse
Critical
Disputed · 9.1 NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Provide malicious XML with external entity declaration
  2. Exploit
    AssertJ parses XML without XXE protection
  3. Execution
    External entity expands during parsing
  4. Impact
    Attacker reads sensitive files or causes denial of service

Vulnerability Assessment

Weakness
CWE
CWE-611
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration XML external entity prevention
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Application must use AssertJ versions 1.4.0 through 3.27.6 and invoke isXmlEqualTo(CharSequence) assertion with untrusted XML input containing external entity declarations. No authentication required; exploitable over network.
Impact

CVSS 9.1. Testing libraries typically run in CI/CD — XXE can read build server secrets, SSH keys, and environment variables.
Exploit ScenarioDerived

Malicious XML test fixture triggers XXE, reading files from the CI/CD server during test execution.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

XXE (XML External Entity) injection in AssertJ Java testing library from 1.4.0 to before 3.27.7 allows reading arbitrary files when parsing XML assertions. Patch available.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 22:00 CVSS 9.1

XXE in AssertJ Java testing assertions library.

RemediationAI

Update to AssertJ 3.27.7.

Affected Packages

maven org.assertj:assertj-core fix: 3.27.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in maven

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

CWE-611 XML External Entity injection. AssertJ's XML parsing does not disable external entity resolution.

Know when Assertj gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
GitHub Advisory PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
SUSE CRITICAL
Red Hat 6.1 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 09, 2026 - 14:15 nvd
Patch available
CVE Published
Jan 26, 2026 - 23:16 nvd
CRITICAL 9.1

DescriptionGitHub Advisory

AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values. An application is vulnerable only when it uses untrusted XML input with either isXmlEqualTo(CharSequence) from org.assertj.core.api.AbstractCharSequenceAssert or xmlPrettyFormat(String) from org.assertj.core.util.xml.XmlStringPrettyFormatter. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via file:// URIs (e.g., /etc/passwd, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace isXmlEqualTo(CharSequence) with XMLUnit, upgrade to version 3.27.7, or avoid using isXmlEqualTo(CharSequence) or XmlStringPrettyFormatter with untrusted input. XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.

Executive ViewAI

Why It Matters

A critical XML processing vulnerability in AssertJ (CVE-2026-24400) affects applications using versions 1.4.0 through 3.27.6, potentially allowing attackers to read sensitive files or conduct denial-of-service attacks through malicious XML inputs to assertion methods. Organizations must immediately identify affected systems and apply the available patch to prevent exploitation.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: disable or restrict usage of isXmlEqualTo() assertion methods, implement input validation to reject DTD declarations in XML test data, and isolate affected test environments from production systems.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Server-Side Request Forgery HIGH

Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.

XML External Entity Injection HIGH

XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:assertj:assertj:*:*:*:*:*:*:*:*

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

View all
CVE-2019-9670 CRITICAL POC
9.8
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2012-3363 CRITICAL POC
9.1
CVE-2016-4264 HIGH POC
8.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
Container suse/sl-micro/6.0/toolbox:13.2-9.1 Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
openSUSE Leap 15.6 Fixed
openSUSE Leap 16.0 Fixed

References

Advisories & patches
PATCH https://github.com/assertj/assertj/commit/85ca7eb6609bb179c043b85ae7d290523b1ba79a ADVISORY https://github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9r ADVISORY https://vuldb.com/vuln/342932 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0344/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20604/ REF https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html REF https://github.com/assertj/assertj/releases/tag/assertj-build-3.27.7

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy