High severity · published Aug 1, 2024
CVE-2024-41946
REXML is an XML toolkit for Ruby
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Rexml · Ruby-lang
before 3.3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-41946
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-41946
Patch
https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368
Vendor Advisory
https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4
Not Applicable
https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml
Vendor Advisory
https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html
security.netapp.com
https://security.netapp.com/advisory/ntap-20250117-0007/
More from Rexml
7.5
CVE-2024-49761
REXML is an XML toolkit for Ruby
7.5
CVE-2024-41123
REXML is an XML toolkit for Ruby
7.5
CVE-2021-28965
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues
5.9
CVE-2024-43398
REXML is an XML toolkit for Ruby
5.3
CVE-2025-58767
REXML is an XML toolkit for Ruby