RHLW-2026-ac67d261e0b1de9a: Lightwell Security Advisory: assertj-core 2.9.0.rhlw-00003
Red Hat Lightwell has released org.assertj:assertj-core 2.9.0.rhlw-00003 with a backported security fix.
CVE-2026-24400: AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
This patched artifact is a drop-in replacement for org.assertj:assertj-core 2.9.0 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/org.assertj:assertj-coreto a version that resolves this vulnerability.Fixed in 2.9.0.rhlw-00003 - Upgrade
Upgrade
org.assertj:assertj-coreto a version that resolves this vulnerability.Fixed in 2.9.0.rhlw-00003
Event History
Frequently Asked Questions
Which usage is exposed to this issue?
The affected scenario is use of AssertJ's isXmlEqualTo assertion to parse untrusted XML. Applications that do not parse untrusted XML through this assertion are not described as exposed by the advisory.
What does an attacker need to exploit the vulnerability?
An attacker needs to cause untrusted XML to be parsed via the isXmlEqualTo assertion. The listed vector indicates network exploitation with low complexity and no required privileges or user interaction.
What remediation is available?
Red Hat Lightwell released org.assertj:assertj-core 2.9.0.rhlw-00003 with a backported fix for CVE-2026-24400. This artifact is described as a drop-in replacement for org.assertj:assertj-core 2.9.0 from Maven Central.