{"id":"CVE-2024-41946","published":"2024-08-01T14:22:14Z","modified":"2025-11-03T20:38:34Z","title":"REXML DoS vulnerability","vendor":"ruby","product":"rexml","tier":"tail","description":{"text":"REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01192,"percentile":0.67968,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368","tags":["x_refsource_MISC"]},{"url":"https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml","tags":["x_refsource_MISC"]},{"url":"https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20250117-0007/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html","tags":[]}],"priority":{"score":17.3,"factors":[{"name":"EPSS percentile","points":13.59},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"ruby","affectedVersions":[{"vendor":"ruby","product":"rexml","versions":["< 3.3.3"]}],"affected":[{"ecosystem":"RubyGems","package":"rexml","vulnerableRanges":["<3.3.3"],"patched":["3.3.3"],"from":["GHSA-5866-49gr-22v4"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2501","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ruby-rexml-cve-2024-35176","children":[{"from":"CVE-2024-41946","to":"CVE-2024-49761","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/rexml/parsers/baseparser.rb"],"commits":["https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368","https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f"],"basis":"shared function","functions":["unnormalize"]}]},{"from":"CVE-2024-41946","to":"CVE-2025-10990","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/rexml/parsers/baseparser.rb"],"commits":["https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368","https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f"],"basis":"shared function","functions":["unnormalize"]}]},{"from":"CVE-2024-41946","to":"CVE-2025-58767","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/rexml/parsers/baseparser.rb"],"commits":["https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368","https://github.com/ruby/rexml/commit/5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23"],"basis":"shared function","functions":["initialize","pull_event"]}]}],"packageHistory":[{"cve":"CVE-2024-35176","published":"2024-05-16","fixed":"3.2.7","kev":false},{"cve":"CVE-2024-39908","published":"2024-07-16","fixed":"3.3.2","kev":false,"link":{"from":"CVE-2024-39908","to":"CVE-2024-41946","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:rexml","fromFixed":"3.3.2","toFixed":"3.3.3","daysApart":16}]}},{"cve":"CVE-2024-41123","published":"2024-08-01","fixed":"3.3.3","kev":false},{"cve":"CVE-2024-41946","published":"2024-08-01","fixed":"3.3.3","kev":false},{"cve":"CVE-2024-43398","published":"2024-08-22","fixed":"3.3.6","kev":false,"link":{"from":"CVE-2024-41946","to":"CVE-2024-43398","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:rexml","fromFixed":"3.3.3","toFixed":"3.3.6","daysApart":21},{"kind":"same-code","provenance":"machine","files":["lib/rexml/parsers/baseparser.rb"],"commits":["https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368","https://github.com/ruby/rexml/commit/7cb5eaeb221c322b9912f724183294d8ce96bae3"],"basis":"shared file"},{"kind":"similar","provenance":"machine","score":0.46,"basis":"same product + description similarity"}]}},{"cve":"CVE-2024-49761","published":"2024-10-28","fixed":"3.3.9","kev":false},{"cve":"CVE-2025-58767","published":"2025-09-17","fixed":"3.4.2","kev":false}],"package":"RubyGems:rexml"}}