CVE-2024-31573

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.

CVE-2024-31573 is fixed in 7 products on 1 platform, first by ALAS2023-2025-1260, released November 10, 2025. It is not reported as exploited. Patch Radar priority: Routine.

Routine

CVSS

4.0

Moderate

Exploitation

None reported

No vendor assessment

CISA KEV

Not listed

Not in the Known Exploited Vulnerabilities catalog

EPSS

0.0032

25th percentile

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.

Where it's fixed

Product	Fixed in	Fix	Released
Linux
xmlunit · amzn 2023	2.8.2-6.amzn2023.0.4	ALAS2023-2025-1260	Nov 10, 2025
xmlunit-assertj · amzn 2023	2.8.2-6.amzn2023.0.4	ALAS2023-2025-1260	Nov 10, 2025
xmlunit-core · amzn 2023	2.8.2-6.amzn2023.0.4	ALAS2023-2025-1260	Nov 10, 2025
xmlunit-javadoc · amzn 2023	2.8.2-6.amzn2023.0.4	ALAS2023-2025-1260	Nov 10, 2025
xmlunit-legacy · amzn 2023	2.8.2-6.amzn2023.0.4	ALAS2023-2025-1260	Nov 10, 2025
xmlunit-matchers · amzn 2023	2.8.2-6.amzn2023.0.4	ALAS2023-2025-1260	Nov 10, 2025
xmlunit-placeholders · amzn 2023	2.8.2-6.amzn2023.0.4	ALAS2023-2025-1260	Nov 10, 2025

Details

Published
October 19, 2025
Weakness
Incorrect Resource Transfer Between Spheres
Vendor advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-31573

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/cve/CVE-2024-31573">CVE-2024-31573 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Is this on your machines?

Patchblox finds every install below the fixed version on Windows, macOS and Linux, and updates them through your release rings.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.