Moderate Security Vulnerability in AssertJ Core: Information Disclosure and Denial of Service
Summary
RLSA-2026:60215: Moderate: assertj-core security update. Affects assertj-core versions < 0:3.19.0-9.el9_8.1. Fixed in 0:3.19.0-9.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
AssertJ Core is a popular Java library that provides a rich set of strongly-typed assertions for unit testing, compatible with both JUnit and TestNG. It enhances the testing experience by allowing developers to write more readable and maintainable test cases. However, a recent security vulnerability has been identified that exposes users to potential information disclosure and denial of service attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2026-24400, stems from an XML External Entity (XXE) issue within the AssertJ library. This flaw allows attackers to manipulate XML input, potentially leading to unauthorized access to sensitive information or causing the application to become unresponsive. The impact of this vulnerability is significant, as it can compromise the integrity of the application and affect overall system performance.
How To Fix
Minimum fixed version
0:3.19.0-9.el9_8.1
This is the first release that contains the fix.
sudo dnf update assertj-coreTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable XML parsing in your application or validate XML input to prevent the processing of external entities. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The AssertJ Core library has a moderate security vulnerability that requires immediate attention. Users are encouraged to update to the latest patched version to safeguard their applications against potential attacks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for assertj-core →
FAQ
CVE-2026-24400 is a security vulnerability in the AssertJ Core library that allows for information disclosure and denial of service through XML External Entity (XXE) attacks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By simply using a manifest file like package-lock.json, you can check if your application is affected without any installation.
If immediate updates are not possible, consider implementing workarounds such as disabling XML parsing or validating XML input to mitigate the risk temporarily.
The vulnerability can lead to unauthorized access to sensitive information and may cause the application to become unresponsive, affecting its overall performance.
More details about CVE-2026-24400 can be found on the official CVE page and through security advisories related to AssertJ Core.
Related vulnerabilities
Recent vulnerabilities recorded for assertj-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
