DEBIAN-CVE-2026-24400
AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqu
DEBIAN-CVE-2026-24400
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-24400
assertj-core
Source reference: /affected/0/package/name
- Affected versions
- 3.14.0-2
Source reference:
/affected/0/versions3.26.3-1Source reference:
/affected/0/versions3.26.3-2Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
assertj-core
Source reference: /affected/1/package/name
- Affected versions
- 3.26.3-2
Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
assertj-core
Source reference: /affected/2/package/name
- Affected versions
- 3.26.3-2
Source reference:
/affected/2/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "assertj-core",
"purl": "pkg:deb/debian/assertj-core?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.14.0-2",
"3.26.3-1",
"3.26.3-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24400.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "assertj-core",
"purl": "pkg:deb/debian/assertj-core?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.26.3-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24400.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "assertj-core",
"purl": "pkg:deb/debian/assertj-core?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.26.3-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24400.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #55892 · Revision 1
- Added to Heist Feed
- Publisher date