PT-2024-7269 · Ruby+11 · Rexml+11
Mprogrammer
·
Published
2024-05-16
·
Updated
2025-10-27
·
CVE-2024-39908
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
REXML versions prior to 3.3.1
REXML versions prior to 3.2.7
Description:
The issue is related to denial-of-service vulnerabilities in the REXML gem for Ruby. When parsing XML with many specific characters, such as
<, 0, and %>, the gem may be impacted. Users who need to parse untrusted XMLs may be affected by these vulnerabilities.Recommendations:
For REXML versions prior to 3.3.1, upgrade to version 3.3.2 or later to fix the vulnerabilities.
For REXML versions prior to 3.2.7, upgrade to version 3.2.7 or later to fix the vulnerability.
As a temporary workaround, consider avoiding the parsing of untrusted XML strings until a patch is available.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Rexml
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu