{"id":"CVE-2024-35176","published":"2024-05-16T15:13:25Z","modified":"2025-11-03T20:37:32Z","title":"REXML contains a denial of service vulnerability","vendor":"ruby","product":"rexml","tier":"tail","description":{"text":" REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02064,"percentile":0.81341,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"},{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"}],"references":[{"url":"https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb","tags":["x_refsource_MISC"]},{"url":"https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20250306-0001/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html","tags":[]}],"priority":{"score":25.0,"factors":[{"name":"EPSS percentile","points":16.27},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":3.71}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-12-19","earliestUrl":"https://github.com/SpiralBL0CK/CVE-2024-35176","repos":[{"name":"SpiralBL0CK/CVE-2024-35176","url":"https://github.com/SpiralBL0CK/CVE-2024-35176","stars":5,"created":"2024-12-19"}]},"first":{"date":"2024-12-19","source":"PoC-in-GitHub","url":"https://github.com/SpiralBL0CK/CVE-2024-35176"},"provenance":"source"},"vendorSlug":"ruby","affectedVersions":[{"vendor":"ruby","product":"rexml","versions":["< 3.2.7"]}],"affected":[{"ecosystem":"RubyGems","package":"rexml","vulnerableRanges":["<3.2.7"],"patched":["3.2.7"],"from":["GHSA-vg3r-rm7w-2xgh"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1802","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ruby-rexml-cve-2024-35176","children":[{"from":"CVE-2024-35176","to":"CVE-2024-41123","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-vg3r-rm7w-2xgh","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-r55c-59qm-vjw6","via":"reference","url":"https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh"}]},{"from":"CVE-2024-35176","to":"CVE-2024-43398","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/rexml/parsers/baseparser.rb"],"commits":["https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb","https://github.com/ruby/rexml/commit/7cb5eaeb221c322b9912f724183294d8ce96bae3"],"basis":"shared function","functions":["parse_attributes"]}]}],"packageHistory":[{"cve":"CVE-2021-28965","published":"2021-04-21","fixed":"3.2.5","kev":false},{"cve":"CVE-2024-35176","published":"2024-05-16","fixed":"3.2.7","kev":false},{"cve":"CVE-2024-39908","published":"2024-07-16","fixed":"3.3.2","kev":false,"link":{"from":"CVE-2024-35176","to":"CVE-2024-39908","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:rexml","fromFixed":"3.2.7","toFixed":"3.3.2","daysApart":61}]}},{"cve":"CVE-2024-41123","published":"2024-08-01","fixed":"3.3.3","kev":false},{"cve":"CVE-2024-41946","published":"2024-08-01","fixed":"3.3.3","kev":false}],"package":"RubyGems:rexml"}}