CVE search · CVE-2024-41123
CVE-2024-41123
high 7.5
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
Details
- Status
- Modified
- Published
- Last changed
- Source
- security-advisories@github.com
- Weakness
- CWE-400
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | medium 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
security-advisories@github.comSecondary |
| CVSS 3.1 | high 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- ruby-lang · rexml
References
- https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8Not Applicable
- https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6Vendor Advisory
- https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xghNot Applicable
- https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html
- https://security.netapp.com/advisory/ntap-20241227-0005/