PT-2024-6381 · Rexml+11 · Rexml+11
Mprogrammer
+1
·
Published
2024-05-16
·
Updated
2025-10-27
·
CVE-2024-41123
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
REXML gem versions prior to 3.3.3
Description
The REXML gem has some DoS vulnerabilities when it parses an XML that has many specific characters, such as whitespace characters,
> and ]>, or <, 0 and %>. This vulnerability is related to uncontrolled resource consumption and can be exploited by a remote attacker to cause a denial of service. If you need to parse untrusted XMLs, you may be impacted by these vulnerabilities.Recommendations
For REXML gem versions prior to 3.3.3, upgrade to version 3.3.3 or later to fix these vulnerabilities. As a temporary workaround, consider not parsing untrusted XMLs to minimize the risk of exploitation. Restricting the parsing of XMLs with many specific characters can also help mitigate the issue.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Rexml
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu