Loading story…
Red Hat released multiple Moderate security advisories for assertj-core in Red Hat Enterprise Linux 9 channels to address CVE-2026-24400, an XML External Entity (XXE) vulnerability in AssertJ. The flaw affects versions from 1.4.0 through before 3.27.7 and stems from org.assertj.core.util.xml.XmlStringPrettyFormatter, where toXmlDocument(String) uses a default DocumentBuilderFactory without disabling DTDs or external entities. Applications that pass untrusted XML to isXmlEqualTo(CharSequence) or xmlPrettyFormat(String) could be exposed to information disclosure, server-side request forgery, or denial of service through entity expansion.
The updates were published across several RHEL 9 product lines, including RHEL 9.2, 9.4, and 9.6 support and SAP-related channels, under advisories RHSA-2026:58956, RHSA-2026:58957, and RHSA-2026:58949. Red Hat shipped updated packages such as assertj-core-3.19.0-5.el9_2.2, assertj-core-3.19.0-5.el9_4.2, and assertj-core-3.19.0-9.el9_6.1 for multiple architectures. Upstream, AssertJ fixed the issue in 3.27.7, deprecated XmlStringPrettyFormatter in that release, and removed it in 4.0, while the older isXmlEqualTo(CharSequence) API had already been deprecated in favor of XMLUnit.
See affected versions and whether adversaries are exploiting it.
13 events from the most recent confirmed update back to the earliest known activity.
Rocky Linux published RLSA-2026:60215 for Rocky Linux 9, updating assertj-core to remediate CVE-2026-24400. The associated Tenable plugin reported no known exploits.
Oracle published security update ELSA-2026-60215-0 for Oracle Linux 9, updating assertj-core to address CVE-2026-24400. The associated Nessus plugin reported no known public exploits.
Red Hat published RHSA-2026:60215 for RHEL EUS 9.8, updating the assertj-core package to remediate the Moderate-severity XXE vulnerability CVE-2026-24400.
Rocky Linux published RLSA-2026:59372 for Rocky Linux 10, updating the assertj-core and assertj-core-javadoc packages to remediate CVE-2026-24400. The advisory reported no known public exploits.
Oracle Linux published security advisory ELSA-2026-59372 for Oracle Linux 10, providing fixes for CVE-2026-24400 in the assertj-core and assertj-core-javadoc packages.
Red Hat published RHSA-2026:59372 for RHEL 10.2, providing updated assertj-core and assertj-core-javadoc packages to address CVE-2026-24400. The advisory classified the XXE flaw as Moderate severity.
On 2026-08-24, Red Hat published RHSA-2026:58957, releasing updated assertj-core 3.19.0-5.el9_4.2 packages for RHEL 9.4 Update Services for SAP Solutions and related channels to remediate CVE-2026-24400.
On 2026-08-24, Red Hat published RHSA-2026:58956, releasing updated assertj-core 3.19.0-5.el9_2.2 packages for RHEL 9.2 channels to fix CVE-2026-24400.
On 2026-08-24, Red Hat published RHSA-2026:58949, releasing updated assertj-core 3.19.0-9.el9_6.1 packages for multiple RHEL 9.6 channels to address CVE-2026-24400.
Red Hat opened Bugzilla entry 2433116 to track CVE-2026-24400, describing an XXE flaw in AssertJ that could enable information disclosure, SSRF, or denial of service when untrusted XML is processed.
AssertJ fixed the XXE vulnerability in version 3.27.7. In the same release, it also deprecated XmlStringPrettyFormatter, the component containing the vulnerable XML parsing behavior.
AssertJ deprecated the isXmlEqualTo(CharSequence) assertion in version 3.18.0 and recommended XMLUnit instead. The deprecated assertion was one of the paths through which untrusted XML could reach the vulnerable formatter.
The vulnerable AssertJ code path for XML processing is present starting in version 1.4.0, making releases from 1.4.0 up to but not including 3.27.7 affected by CVE-2026-24400.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
10 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for `libxml2` to remediate CVE-2024-56171, a use-after-free in XML Schema identity-constraint validation, and CVE-2025-24928, a stack-based buffer overflow in `xmlSnprintfElements()` during DTD validation. Both flaws affect libxml2 releases before 2.12.10 and 2.13.x before 2.13.6; exploitation requires processing crafted XML documents, schemas, or DTDs through vulnerable validation paths. Advisories include RHSA-2025:2673 for RHEL 7 Extended Lifecycle Support, providing `libxml2-2.9.1-6.el7_9.9`, and RHSA-2025:2660 for specified RHEL 8.4 ELL, AUS, TUS, and SAP support channels, providing `libxml2-2.9.7-9.el8_4.5`. OpenShift Container Platform 4.15.48 also remediates both issues through updated container images; organizations should apply the relevant RHEL or OpenShift update across supported architectures and restrict validation of untrusted XML content until patching is complete.
Aug 26, 2026
Red Hat released multiple **Important** security advisories for `gstreamer1-plugins-bad-free` across **Red Hat Enterprise Linux 9 and 10**, fixing two GStreamer vulnerabilities tracked as **`CVE-2026-59691`** and **`CVE-2026-59692`**. The first flaw is a heap out-of-bounds write in `rfbsrc/librfb` Hextile handling when processing a **16bpp framebuffer**, while the second is a stack buffer overflow in `openssl_verify_callback` tied to a **DTLS certificate Subject DN**. The advisories cover standard and extended support channels, including RHEL 9.4, 9.6, 9.8, and RHEL 10.0 product variants. Updated packages were issued for multiple architectures, including **`x86_64`**, **`aarch64`**, **`ppc64le`**, and **`s390x`**, with package versions including `1.22.1-6.el9_4.6`, `1.22.12-5.el9_6.6`, `1.22.12-7.el9_8.3`, `1.24.11-3.el10_0.6`, and `1.26.7-2.el10_2.6`. Affected offerings also include **Extended Update Support**, **Extended Life Cycle**, **SAP Solutions update services**, **4-years-of-updates/support variants**, and **CodeReady Linux Builder** repositories. Red Hat instructed customers to apply the updated packages through standard patching processes to remediate affected systems.
Aug 20, 2026
Red Hat released **Important** security updates for Node.js packages across **RHEL 8, 9, and 10**, covering `nodejs:22`, `nodejs:24`, and `nodejs22` builds affected by vulnerabilities in bundled or related components. The advisories address **`CVE-2026-69192`** in the `ip-address` JavaScript library, where inconsistent parsing of IPv4 octets with leading zeros can cause applications to treat internal addresses as external, enabling **server-side request forgery (SSRF)** and trust-boundary bypass. Red Hat published errata including **RHSA-2026:54371**, **RHSA-2026:54530**, **RHSA-2026:55601**, **RHSA-2026:55603**, and **RHSA-2026:55541** for affected RHEL product streams and architectures. The updates also fix **`CVE-2026-69152`**, a high-severity denial-of-service flaw in `brace-expansion` that can exhaust memory or block the Node.js event loop through unbounded intermediate arrays, bypassing an earlier mitigation for **`CVE-2026-14257`**. Several advisories additionally include fixes for SQLite FTS5 arbitrary code execution issues bundled with Node.js-related packages. Red Hat said the `ip-address` issue is fixed in version **`10.3.1`**, while affected `brace-expansion` releases are corrected in versions prior to **`1.1.18`**, **`2.1.4`**, **`3.0.6`**, and **`5.0.9`**, with updated Node.js, `npm`, and related development packages now available for supported RHEL platforms.
Sep 4, 2026