PT-2024-8321 · Ruby +11 · Ruby +11
Manun
·
Published
2024-10-28
·
Updated
2025-07-15
·
CVE-2024-49761
7.8
High
| Base vector | Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
REXML gem versions prior to 3.3.9
Ruby 3.1
Description:
The issue is related to a ReDoS vulnerability in the REXML gem when parsing XML with many digits between `&#` and `x...;` in a hex numeric character reference (`&#x...;`). This vulnerability can be exploited to perform a denial-of-service attack. The vulnerability does not affect Ruby 3.2 or later. Ruby 3.1 is the only maintained Ruby version that is affected.
Recommendations:
For REXML gem versions prior to 3.3.9, update to version 3.3.9 or later to fix the vulnerability.
For Ruby 3.1, consider using Ruby 3.2 or later instead, as Ruby 3.1 will reach end-of-life in 2025.
Exploit
Fix
DoS
Weakness Enumeration
Related Identifiers
Affected Products
References · 131
- 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-49761.yml⭐ 1022 🔗 220 · Exploit
- 🔥 https://github.com/SpiralBL0CK/CVE-2024-35176⭐ 5 🔗 2 · Exploit
- https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f⭐ 153 🔗 79 · Patch
- https://errata.rockylinux.org/RLSA-2024:10834 · Vendor Advisory
- https://errata.almalinux.org/9/ALSA-2024-10858.html · Vendor Advisory
- https://safe-surf.ru/specialists/bulletins-nkcki/721794 · Security Note
- https://linux.oracle.com/errata/ELSA-2024-10860.html · Vendor Advisory
- https://osv.dev/vulnerability/RLSA-2024:10860 · Vendor Advisory
- https://bdu.fstec.ru/vul/2024-09876 · Security Note
- https://security-tracker.debian.org/tracker/DLA-4018-2 · Vendor Advisory
- https://security-tracker.debian.org/tracker/DLA-4018-1 · Vendor Advisory
- https://osv.dev/vulnerability/RLSA-2024:10858 · Vendor Advisory
- https://errata.almalinux.org/8/ALSA-2024-10834.html · Vendor Advisory
- https://osv.dev/vulnerability/RLSA-2024:10850 · Vendor Advisory
- https://errata.almalinux.org/9/ALSA-2024-10860.html · Vendor Advisory