Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
XMLUnit libraries could be exploited without update
published 8 days ago
Summary
The XMLUnit family of Java libraries (xmlunit-assertj, xmlunit-core, xmlunit-legacy, xmlunit-matchers, xmlunit-parent) contain a security weakness that could let an attacker manipulate XML processing. This could lead to unexpected behavior or data exposure in applications that use these libraries. Apply the TuxCare-provided version 2.6.3‑tuxcare.1 or later to remove the risk.
What to do
- Update xmlunit org.xmlunit:xmlunit-assertj to version 2.6.3-tuxcare.1.
- Update xmlunit org.xmlunit:xmlunit-core to version 2.6.3-tuxcare.1.
- Update xmlunit org.xmlunit:xmlunit-legacy to version 2.6.3-tuxcare.1.
- Update xmlunit org.xmlunit:xmlunit-matchers to version 2.6.3-tuxcare.1.
- Update xmlunit org.xmlunit:xmlunit-parent to version 2.6.3-tuxcare.1.
- Update xmlunit org.xmlunit:xmlunit-placeholders to version 2.6.3-tuxcare.1.
- Update org.xmlunit:xmlunit-assertj to version 2.6.3-tuxcare.1.
- Update org.xmlunit:xmlunit-core to version 2.6.3-tuxcare.1.
- Update org.xmlunit:xmlunit-legacy to version 2.6.3-tuxcare.1.
- Update org.xmlunit:xmlunit-matchers to version 2.6.3-tuxcare.1.
- Update org.xmlunit:xmlunit-placeholders to version 2.6.3-tuxcare.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | xmlunit | org.xmlunit:xmlunit-assertj |
>= 2.6.3, < 2.6.3-tuxcare.1 Fix: upgrade to 2.6.3-tuxcare.1
|
| TuxCare:Maven | xmlunit | org.xmlunit:xmlunit-core |
>= 2.6.3, < 2.6.3-tuxcare.1 Fix: upgrade to 2.6.3-tuxcare.1
|
| TuxCare:Maven | xmlunit | org.xmlunit:xmlunit-legacy |
>= 2.6.3, < 2.6.3-tuxcare.1 Fix: upgrade to 2.6.3-tuxcare.1
|
| TuxCare:Maven | xmlunit | org.xmlunit:xmlunit-matchers |
>= 2.6.3, < 2.6.3-tuxcare.1 Fix: upgrade to 2.6.3-tuxcare.1
|
| TuxCare:Maven | xmlunit | org.xmlunit:xmlunit-parent |
>= 2.6.3, < 2.6.3-tuxcare.1 Fix: upgrade to 2.6.3-tuxcare.1
|
| TuxCare:Maven | xmlunit | org.xmlunit:xmlunit-placeholders |
>= 2.6.3, < 2.6.3-tuxcare.1 Fix: upgrade to 2.6.3-tuxcare.1
|
| TuxCare:Maven | – | org.xmlunit:xmlunit-assertj |
>= 2.6.3, < 2.6.3-tuxcare.1 Fix: upgrade to 2.6.3-tuxcare.1
|
| TuxCare:Maven | – | org.xmlunit:xmlunit-core |
>= 2.6.3, < 2.6.3-tuxcare.1 Fix: upgrade to 2.6.3-tuxcare.1
|
| TuxCare:Maven | – | org.xmlunit:xmlunit-legacy |
>= 2.6.3, < 2.6.3-tuxcare.1 Fix: upgrade to 2.6.3-tuxcare.1
|
| TuxCare:Maven | – | org.xmlunit:xmlunit-matchers |
>= 2.6.3, < 2.6.3-tuxcare.1 Fix: upgrade to 2.6.3-tuxcare.1
|
| TuxCare:Maven | – | org.xmlunit:xmlunit-placeholders |
>= 2.6.3, < 2.6.3-tuxcare.1 Fix: upgrade to 2.6.3-tuxcare.1
|
Original advisory text
TuxCare security update for org.xmlunit:xmlunit-core (1 CVE)
TuxCare rebuilt org.xmlunit:xmlunit-core to address 1 CVE. Fixed in 2.6.3-tuxcare.1.
Timeline
Published27 Oct 2026
Updated2 Nov 2026
First seen28 Oct 2026
Sources
CLSA-2026-1793128026 · OSV
Track software like this
Free during beta