CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
An XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values.
An application is vulnerable only when it uses untrusted XML input with one of the following methods:
- isXmlEqualTo(CharSequence) from org.assertj.core.api.AbstractCharSequenceAssert - xmlPrettyFormat(String) from org.assertj.core.util.xml.XmlStringPrettyFormatter
Impact
If untrusted XML input is processed by the methods mentioned above (e.g., in test environments handling external fixture files), an attacker could:
- Read arbitrary local files via file:// URIs (e.g., /etc/passwd, application configuration files) - Perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs - Cause Denial of Service via "Billion Laughs" entity expansion attacks
Mitigation
isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference:
1. Replace isXmlEqualTo(CharSequence) with XMLUnit, or 2. Upgrade to version 3.27.7, or 3. Avoid using isXmlEqualTo(CharSequence) or XmlStringPrettyFormatter with untrusted input.
XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.
References
- CWE-611: Improper Restriction of XML External Entity Reference - OWASP XXE Prevention Cheat Sheet
Other sources
AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values. An application is vulnerable only when it uses untrusted XML input with either isXmlEqualTo(CharSequence) from org.assertj.core.api.AbstractCharSequenceAssert or xmlPrettyFormat(String) from org.assertj.core.util.xml.XmlStringPrettyFormatter. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via file:// URIs (e.g., /etc/passwd, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace isXmlEqualTo(CharSequence) with XMLUnit, upgrade to version 3.27.7, or avoid using isXmlEqualTo(CharSequence) or XmlStringPrettyFormatter with untrusted input. XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.assertj:assertj-coreto a version that resolves this vulnerability.Fixed in 3.27.7 - Upgrade
Upgrade
org.assertj.core.util.xml.XmlStringPrettyFormatterto a version that resolves this vulnerability.Fixed in 3.27.7 - Configuration
Avoid using org.assertj.core.api.AbstractCharSequenceAssert.isXmlEqualTo(CharSequence) when the XML input is untrusted (e.g., in test environments that handle external fixture files).
Assertions usage (AssertJ) isXmlEqualTo(CharSequence) with untrusted XML input = do not use - Configuration
Avoid using org.assertj.core.util.xml.XmlStringPrettyFormatter.xmlPrettyFormat(String) with untrusted XML input.
Assertions/Utilities usage (AssertJ) xmlPrettyFormat(String) with untrusted input = do not use - Configuration
Replace org.assertj.core.api.AbstractCharSequenceAssert.isXmlEqualTo(CharSequence) with XMLUnit when comparing XML from untrusted sources.
Assertions usage (AssertJ) isXmlEqualTo(CharSequence) = replace with XMLUnit
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24400?
CVE-2026-24400 has a medium severity rating due to its potential for XML External Entity (XXE) attacks when parsing untrusted XML.
How do I fix CVE-2026-24400?
To fix CVE-2026-24400, upgrade to AssertJ version 3.27.7 or later, which mitigates the XXE vulnerability.
Which versions of AssertJ are affected by CVE-2026-24400?
CVE-2026-24400 affects AssertJ versions from 1.4.0 to 3.27.6, inclusive.
What vulnerability type is CVE-2026-24400?
CVE-2026-24400 is classified as an XML External Entity (XXE) vulnerability.
What component is vulnerable in CVE-2026-24400?
The vulnerable component in CVE-2026-24400 is the 'org.assertj.core.util.xml.XmlStringPrettyFormatter' when using the 'isXmlEqualTo' assertion.