The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM). Starting in     version 1.4.0 and prior to version 3.27.7, an XML External Entity (XXE) vulnerability exists in     `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes     `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This     formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values. An application     is vulnerable only when it uses untrusted XML input with either `isXmlEqualTo(CharSequence)` from     `org.assertj.core.api.AbstractCharSequenceAssert` or `xmlPrettyFormat(String)` from     `org.assertj.core.util.xml.XmlStringPrettyFormatter`. If untrusted XML input is processed by tone of these     methods, an attacker couldnread arbitrary local files via `file://` URIs (e.g., `/etc/passwd`, application     configuration files); perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs, and/or cause Denial     of Service via Billion Laughs entity expansion attacks. `isXmlEqualTo(CharSequence)` has been deprecated     in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions     should, in order of preference: replace `isXmlEqualTo(CharSequence)` with XMLUnit, upgrade to version     3.27.7, or avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input.
    `XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)`     rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0,     with no replacement. (CVE-2026-24400)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-24400

high Nessus Plugin ID 296899

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Feb 3, 2026, 5:59 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602030559
Version 1.2 Jan 31, 2026, 11:07 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601311107
Version 1.1 Jan 28, 2026, 2:00 AM New Plugin Feed: 202601280200