High severity · published Oct 28, 2024
CVE-2024-49761
REXML ReDoS vulnerability
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
rexml · ruby
< 3.3.9 · source: vendor, NVD, CISA
OT
Ontap Tools · Netapp
10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-49761
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-49761
Patch
https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
Third Party Advisory
https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
Vendor Advisory
https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html
Third Party Advisory
https://security.netapp.com/advisory/ntap-20241227-0004/
More from rexml
7.5
CVE-2024-41946
REXML DoS vulnerability
7.5
CVE-2024-41123
REXML DoS vulnerability
5.9
CVE-2024-43398
REXML denial of service vulnerability
5.3
CVE-2025-58767
REXML has a DoS condition when parsing malformed XML file
4.3
CVE-2024-39908
Denial of service in REXML