https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T03:45:03.164570+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:59372 ALSA-2026:59372 — Moderate: assertj-core security update 2026-10-04T03:45:03.513708+00:00

Affected: AlmaLinux:10: assertj-core, AlmaLinux:10: assertj-core-javadoc

A rich and intuitive set of strongly-typed assertions to use for unit testing (either with JUnit or TestNG).

Security Fix(es):

* assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) (CVE-2026-24400)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-01709 bdu:2026-01709 2026-10-04T03:45:03.513787+00:00 bdu:2026-01709 https://cve.radiocsirt.org/vuln/euvd-2026-266747 EUVD-2026-266747 2026-10-04T03:45:03.513805+00:00 EUVD-2026-266747 https://cve.radiocsirt.org/vuln/fkie_cve-2026-24400 fkie_cve-2026-24400 2026-10-04T03:45:03.513817+00:00

AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEq…

 https://cve.radiocsirt.org/vuln/ghsa-rqfh-9r24-8c9r GHSA-rqfh-9r24-8c9r — AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion 2026-10-04T03:45:03.513855+00:00

Affected: Maven: org.assertj:assertj-core

An XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values.

An application is vulnerable only when it uses untrusted XML input with one of the following methods:

- `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` - `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`

### Impact

If untrusted XML input is processed by the methods mentioned above (e.g., in test environments handling external fixture files), an attacker could:

- **Read arbitrary local files** via `file://` URIs (e.g., `/etc/passwd`, application configuration files) - **Perform Server-Side Request Forgery (SSRF)** via HTTP/HTTPS URIs - **Cause Denial of Service** via "Billion Laughs" entity expansion attacks

### Mitigation

`isXmlEqualTo(CharSequence)` has been deprecated in favor of [XMLUnit](https://www.xmlunit.org/) in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference:

1. Replace `isXmlEqualTo(CharSequence)` with XMLUnit, or 2. Upgrade to version 3.27.7, or 3. Avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input.

`XmlStringPrettyFormatter` has historically been co…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10106-1 openSUSE-SU-2026:10106-1 — assertj-core-3.27.7-1.1 on GA media 2026-10-04T03:45:03.513898+00:00

assertj-core-3.27.7-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:37390 RHSA-2026:37390 — Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.1.P1 for Spring Boot release. 2026-10-04T03:45:03.513916+00:00

assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion netty-codec-redis: Netty: Command injection via CRLF characters in Redis codec encoder netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression netty: io.netty/netty-codec-mqtt: Netty: Denial of Service due to excessive resource consumption from crafted MQTT 5 header netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payl…

 https://cve.radiocsirt.org/vuln/rlsa-2026:59372 RLSA-2026:59372 — Moderate: assertj-core security update 2026-10-04T03:45:03.513990+00:00

Affected: Rocky Linux:10: assertj-core

A rich and intuitive set of strongly-typed assertions to use for unit testing (either with JUnit or TestNG).

Security Fix(es):

* assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) (CVE-2026-24400)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:0344-1 SUSE-SU-2026:0344-1 — Security update for assertj-core 2026-10-04T03:45:03.514014+00:00

Security update for assertj-core

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-24400 UBUNTU-CVE-2026-24400 2026-10-04T03:45:03.514030+00:00

Affected: Ubuntu:16.04:LTS: assertj-core, Ubuntu:18.04:LTS: assertj-core, Ubuntu:20.04:LTS: assertj-core, Ubuntu:22.04:LTS: assertj-core, Ubuntu:24.04:LTS: assertj-core, Ubuntu:25.10: assertj-core, Ubuntu:26.04:LTS: assertj-core

AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial of Service via "Billion Laughs" entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version 3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input. `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEq…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0851 WID-SEC-W-2026-0851 — IBM InfoSphere Information Server: Mehrere Schwachstellen 2026-10-04T03:45:03.514070+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial of Service zu verursachen, einen Cross Site Scripting und CSRF Angriff durchzuführen, Informationen offenzulegen und Daten zu manipulieren.