CVE-2026-24400

AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.

• CWE-611

• https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.htmlTechnical Description
• https://github.com/assertj/assertj/commit/85ca7eb6609bb179c043b85ae7d290523b1ba79aPatch
• https://github.com/assertj/assertj/releases/tag/assertj-build-3.27.7Product, Release Notes
• https://github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9rMitigation, Vendor Advisory

Published

Jan 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24390Improper Control of Filename for Include/Require Statement i…7.5
• CVE-2026-24391Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-24392Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2026-24398Hono is a Web application framework that provides support fo…6.5
• CVE-2026-24399ChatterMate is a no-code AI chatbot agent framework. In vers…5.4
• CVE-2026-2440The SurveyJS plugin for WordPress is vulnerable to Stored Cr…7.2
• CVE-2026-24401Avahi is a system which facilitates service discovery on a l…6.5
• CVE-2026-24402Rejected reason: GitHub cannot issue a CVE for this Security…
• CVE-2026-24403iccDEV provides libraries and tools for interacting with, ma…8.8
• CVE-2026-24404iccDEV provides libraries and tools for interacting with, ma…8.8
• CVE-2026-24405iccDEV provides libraries and tools for interacting with, ma…8.8
• CVE-2026-24406iccDEV provides libraries and tools for interacting with, ma…8.8