CVEvulnerability
CVE-2024-41946
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-08-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
Description
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
Affected configurations
• ruby-lang rexml (< 3.3.3)
Related
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368 Patch
- https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4 Vendor Advisory
- https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml Not Applicable
- https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html lists.debian.org
- https://security.netapp.com/advisory/ntap-20250117-0007/ security.netapp.com