CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion

Published Jan 26, 2026
·
Updated

An XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values.

An application is vulnerable only when it uses untrusted XML input with one of the following methods:

- isXmlEqualTo(CharSequence) from org.assertj.core.api.AbstractCharSequenceAssert - xmlPrettyFormat(String) from org.assertj.core.util.xml.XmlStringPrettyFormatter

Impact

If untrusted XML input is processed by the methods mentioned above (e.g., in test environments handling external fixture files), an attacker could:

- Read arbitrary local files via file:// URIs (e.g., /etc/passwd, application configuration files) - Perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs - Cause Denial of Service via "Billion Laughs" entity expansion attacks

Mitigation

isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference:

1. Replace isXmlEqualTo(CharSequence) with XMLUnit, or 2. Upgrade to version 3.27.7, or 3. Avoid using isXmlEqualTo(CharSequence) or XmlStringPrettyFormatter with untrusted input.

XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.

References

- CWE-611: Improper Restriction of XML External Entity Reference - OWASP XXE Prevention Cheat Sheet

Other sources

AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values. An application is vulnerable only when it uses untrusted XML input with either isXmlEqualTo(CharSequence) from org.assertj.core.api.AbstractCharSequenceAssert or xmlPrettyFormat(String) from org.assertj.core.util.xml.XmlStringPrettyFormatter. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via file:// URIs (e.g., /etc/passwd, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace isXmlEqualTo(CharSequence) with XMLUnit, upgrade to version 3.27.7, or avoid using isXmlEqualTo(CharSequence) or XmlStringPrettyFormatter with untrusted input. XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.

MITRE

Affected Software

3 affected componentsFixes available
maven/org.assertj:assertj-core>=1.4.0<=3.27.6
3.27.7
AssertJ AssertJ>=1.4.0<3.27.7
IBM watsonx.data intelligence<=5.2.0, 5.2.1, 5.3.0, 5.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade maven/org.assertj:assertj-core to a version that resolves this vulnerability.

    Fixed in 3.27.7
  2. Upgrade

    Upgrade org.assertj.core.util.xml.XmlStringPrettyFormatter to a version that resolves this vulnerability.

    Fixed in 3.27.7
  3. Configuration

    Avoid using org.assertj.core.api.AbstractCharSequenceAssert.isXmlEqualTo(CharSequence) when the XML input is untrusted (e.g., in test environments that handle external fixture files).

    Assertions usage (AssertJ) isXmlEqualTo(CharSequence) with untrusted XML input = do not use
  4. Configuration

    Avoid using org.assertj.core.util.xml.XmlStringPrettyFormatter.xmlPrettyFormat(String) with untrusted XML input.

    Assertions/Utilities usage (AssertJ) xmlPrettyFormat(String) with untrusted input = do not use
  5. Configuration

    Replace org.assertj.core.api.AbstractCharSequenceAssert.isXmlEqualTo(CharSequence) with XMLUnit when comparing XML from untrusted sources.

    Assertions usage (AssertJ) isXmlEqualTo(CharSequence) = replace with XMLUnit

Event History

Jan 26, 2026
Advisory Published
via GitHub·09:31 PM
Data Sourced
via GitHub·09:31 PM
DescriptionWeaknessAffected Software
CVE Published
via MITRE·10:19 PM
Data Sourced
via MITRE·10:19 PM
DescriptionWeakness
Data Sourced
via Red Hat·11:01 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:16 PM
RemedyAffected Software
Apr 27, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-24400?

CVE-2026-24400 has a medium severity rating due to its potential for XML External Entity (XXE) attacks when parsing untrusted XML.

2

How do I fix CVE-2026-24400?

To fix CVE-2026-24400, upgrade to AssertJ version 3.27.7 or later, which mitigates the XXE vulnerability.

3

Which versions of AssertJ are affected by CVE-2026-24400?

CVE-2026-24400 affects AssertJ versions from 1.4.0 to 3.27.6, inclusive.

4

What vulnerability type is CVE-2026-24400?

CVE-2026-24400 is classified as an XML External Entity (XXE) vulnerability.

5

What component is vulnerable in CVE-2026-24400?

The vulnerable component in CVE-2026-24400 is the 'org.assertj.core.util.xml.XmlStringPrettyFormatter' when using the 'isXmlEqualTo' assertion.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203