CVEvulnerability
CVE-2024-41123
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-08-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
Description
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
Affected configurations
• ruby-lang rexml (< 3.2.7)
• ruby-lang rexml (>= 3.2.8 < 3.3.2)
Related
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8 Not Applicable
- https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6 Vendor Advisory
- https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh Not Applicable
- https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html lists.debian.org
- https://security.netapp.com/advisory/ntap-20241227-0005/ security.netapp.com