ADVISORIES

• CVE-2024-39908 (NVD)
• GHSA-4xqq-m2hx-25v8
• Vendor Advisory

GEM

rexml

SEVERITY

CVSS v3.x: 4.3 (Medium)

PATCHED VERSIONS

• >= 3.3.2

DESCRIPTION

There is a DoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier CVE-2024-39908. We strongly recommend upgrading the REXML gem.

Details

When it parses an XML that has many specific characters such as <, 0 and %>. REXML gem may take long time.

Please update REXML gem to version 3.3.2 or later.

Affected versions

REXML gem 3.3.2 or prior

Credits

Thanks to mprogrammer for discovering this issue.

History

Originally published at 2024-07-16 03:00:00 (UTC)

RELATED

• GHSA-https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh
• https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908
• https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8