{"id":"CVE-2024-49761","published":"2024-10-28T14:10:23Z","modified":"2025-11-03T20:41:10Z","title":"REXML ReDoS vulnerability","vendor":"ruby","product":"rexml","tier":"tail","description":{"text":"REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.6,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0142,"percentile":0.728,"provenance":"source"},"cwes":[{"id":"CWE-1333","name":"Inefficient Regular Expression Complexity"}],"references":[{"url":"https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f","tags":["x_refsource_MISC"]},{"url":"https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20241227-0004/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html","tags":[]}],"priority":{"score":19.2,"factors":[{"name":"EPSS percentile","points":14.56},{"name":"CVSS severity","points":4.62}]},"vendorSlug":"ruby","affectedVersions":[{"vendor":"ruby","product":"rexml","versions":["< 3.3.9"]}],"affected":[{"ecosystem":"RubyGems","package":"rexml","vulnerableRanges":["<3.3.9"],"patched":["3.3.9"],"from":["GHSA-2rxp-v6pw-ch6m"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2910","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ruby-rexml-cve-2024-35176","parents":[{"from":"CVE-2024-41946","to":"CVE-2024-49761","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/rexml/parsers/baseparser.rb"],"commits":["https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368","https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f"],"basis":"shared function","functions":["unnormalize"]}]}],"children":[{"from":"CVE-2024-49761","to":"CVE-2025-10990","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This issue is the result of an incomplete fix for CVE-2024-49761.","from":"CVE.org","in":"CVE-2025-10990"},{"kind":"osv-related","provenance":"source","id":"GHSA-2rxp-v6pw-ch6m","via":"reference","url":"https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m"}]}],"packageHistory":[{"cve":"CVE-2024-41123","published":"2024-08-01","fixed":"3.3.3","kev":false},{"cve":"CVE-2024-41946","published":"2024-08-01","fixed":"3.3.3","kev":false},{"cve":"CVE-2024-43398","published":"2024-08-22","fixed":"3.3.6","kev":false,"link":{"from":"CVE-2024-43398","to":"CVE-2024-49761","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:rexml","fromFixed":"3.3.6","toFixed":"3.3.9","daysApart":67},{"kind":"same-code","provenance":"machine","files":["lib/rexml/parsers/baseparser.rb"],"commits":["https://github.com/ruby/rexml/commit/7cb5eaeb221c322b9912f724183294d8ce96bae3","https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f"],"basis":"shared file"}]}},{"cve":"CVE-2024-49761","published":"2024-10-28","fixed":"3.3.9","kev":false},{"cve":"CVE-2025-58767","published":"2025-09-17","fixed":"3.4.2","kev":false,"link":{"from":"CVE-2024-49761","to":"CVE-2025-58767","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:rexml","fromFixed":"3.3.9","toFixed":"3.4.2","daysApart":324},{"kind":"same-code","provenance":"machine","files":["lib/rexml/parsers/baseparser.rb"],"commits":["https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f","https://github.com/ruby/rexml/commit/5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23"],"basis":"shared file"}]}}],"package":"RubyGems:rexml"}}