RHLW-2026-3db178bdd1ab8228: Lightwell Security Advisory: assertj-core 3.9.1.rhlw-00007
Red Hat Lightwell has released org.assertj:assertj-core 3.9.1.rhlw-00007 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 3.9.1 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/org.assertj:assertj-coreto a version that resolves this vulnerability.Fixed in 3.9.1.rhlw-00007 - Upgrade
Upgrade
org.assertj:assertj-coreto a version that resolves this vulnerability.Fixed in 3.9.1.rhlw-00007
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using org.assertj:assertj-core 3.9.1 are exposed when they parse untrusted XML through the isXmlEqualTo assertion. The affected component is typically used in test code, so exposure depends on whether untrusted XML can reach that assertion.
What does an attacker need to exploit the vulnerability?
An attacker needs to supply XML that is treated as untrusted input and is parsed by AssertJ's isXmlEqualTo assertion. The advisory's vector indicates exploitation can be performed remotely without privileges or user interaction.
What should be used to remediate the issue?
Replace org.assertj:assertj-core 3.9.1 from Maven Central with Red Hat Lightwell's org.assertj:assertj-core 3.9.1.rhlw-00007. The advisory states that this patched artifact is a drop-in replacement and contains a backported security fix.