CVE-2026-24400

CVE-2026-24400 is an XML External Entity (XXE) vulnerability in AssertJ versions 1.4.0 through 3.27.6, specifically within the XmlStringPrettyFormatter and isXmlEqualTo(CharSequence) methods. This vulnerability allows an attacker to read local files, perform Server-Side Request Forgery (SSRF), or cause Denial of Service (DoS) if untrusted XML input is processed by these methods. With a CVSS score of 8.2 (High), the vulnerability has a low attack complexity and requires no user interaction, potentially leading to high confidentiality and availability impacts. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating awareness and concern.