High severity · published Aug 1, 2024
CVE-2024-41123
REXML is an XML toolkit for Ruby
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Rexml · Ruby-lang
before 3.2.7; 3.2.8 before 3.3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-41123
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-41123
Not Applicable
https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8
Vendor Advisory
https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6
Not Applicable
https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh
Vendor Advisory
https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html
security.netapp.com
https://security.netapp.com/advisory/ntap-20241227-0005/
More from Rexml
7.5
CVE-2024-49761
REXML is an XML toolkit for Ruby
7.5
CVE-2024-41946
REXML is an XML toolkit for Ruby
7.5
CVE-2021-28965
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues
5.9
CVE-2024-43398
REXML is an XML toolkit for Ruby
5.3
CVE-2025-58767
REXML is an XML toolkit for Ruby