PT-2024-6376 · Ruby+11 · Rexml+11
Naitoh
·
Published
2024-08-01
·
Updated
2026-03-29
·
CVE-2024-41946
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
REXML versions prior to 3.3.3
Description
The issue is related to an uncontrolled resource consumption in the REXML XML toolkit for Ruby. When REXML parses an XML with many entity expansions using the SAX2 or pull parser API, it can lead to a denial of service. If untrusted XMLs are parsed with SAX2 or pull parser API, users may be impacted by this issue.
Recommendations
For versions prior to 3.3.3, update to REXML gem 3.3.3 or later to fix the vulnerability.
As a temporary workaround, avoid parsing untrusted XMLs with SAX2 or pull parser API until the issue is resolved.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Rexml
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu