PT-2024-6382 · Rexml+11 · Rexml+11
Lowkou
·
Published
2024-08-22
·
Updated
2025-11-03
·
CVE-2024-43398
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
REXML versions prior to 3.3.6
Description
The REXML gem has a DoS vulnerability when it parses an XML that has many deep elements that have the same local name attributes. This issue affects users who need to parse untrusted XMLs with the tree parser API, such as
REXML::Document.new. However, users of other parser APIs like stream parser API and SAX2 parser API are not affected.Recommendations
For versions prior to 3.3.6, update to REXML gem 3.3.6 or later to fix the vulnerability.
As a temporary workaround, consider not parsing untrusted XMLs with the tree parser API until a patch is available.
Exploit
Fix
DoS
XML Entity Expansion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Linuxmint
Apple Macos
Rexml
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu