CVE-2024-41946

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-41946
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368 Patch
https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4 Vendor Advisory
https://security.netapp.com/advisory/ntap-20250117-0007/
https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml Not Applicable
https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*
History

17 Jan 2025, 20:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20250117-0007/ -

05 Sep 2024, 16:09

Type Values Removed Values Added
CWE CWE-400
References () https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4 - () https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4 - Vendor Advisory
References () https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml - () https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml - Not Applicable
References () https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368 - () https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368 - Patch
References () https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946 - () https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946 - Vendor Advisory
CPE cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
First Time Ruby-lang rexml
Ruby-lang

01 Aug 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-01 15:15

Updated : 2025-01-17 20:15

NVD link : CVE-2024-41946

Mitre link : CVE-2024-41946

JSON object : View

Products Affected

ruby-lang

  • rexml
CWE
CWE-400

Uncontrolled Resource Consumption