GitHub Advisoryadvisory · RubyGems
GHSA-vg3r-rm7w-2xgh REXML contains a denial of service vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2024-35176
- Ecosystem
- RubyGems
- Packages
- rexml
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-400
- Reviewed
- 2024-05-16
Affected packages
• RubyGems rexml: < 3.2.7 → fixed in 3.2.7
Description
Impact
The REXML gem before 3.2.6 has a DoS vulnerability when it parses an XML that has many `>`s in an attribute value.
If you need to parse untrusted XMLs, you may be impacted to this vulnerability.
Patches
The REXML gem 3.2.7 or later include the patch to fix this vulnerability.
Workarounds
Don't parse untrusted XMLs.
References
• https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/
Related
Alias · CVE (1)
- CVE-2024-35176 REXML is an XML toolkit for Ruby. vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh web
- https://nvd.nist.gov/vuln/detail/CVE-2024-35176 advisory
- https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb web
- https://github.com/ruby/rexml package
- https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html web
- https://security.netapp.com/advisory/ntap-20250306-0001 web
- https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176 web