CVE-2024-49761
HIGHREXML < 3.3.9 - Inefficient Regular Expression Complexity in Hex Numeric Character Reference Parsing
Title source: llmDescription
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
References (5)
Core 5
Core References
Third Party Advisory
https://security.netapp.com/advisory/ntap-20241227-0004/
Third Party Advisory x_refsource_confirm
https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
Patch x_refsource_misc
https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
Vendor Advisory x_refsource_misc
https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
Scores
CVSS v3
7.5
EPSS
0.0143
EPSS Percentile
69.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-1333
Status
published
Products (3)
netapp/ontap_tools
10
ruby-lang/rexml
< 3.3.9
rubygems/rexml
0 - 3.3.9RubyGems
Published
Oct 28, 2024
Tracked Since
Feb 18, 2026