GHSA-2rxp-v6pw-ch6m CVE-2024-49761 CVE-2025-10990
REXML ReDoS vulnerability
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 1.42%
- Chance of exploitation in the next 30 days. Higher than 72.83% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1333 Inefficient Regular Expression Complexity
- Fix
3.3.9- Upgrade rexml to this version or later
Description
Impact
The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;).
This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.
Patches
The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
Workarounds
Use Ruby 3.2 or later instead of Ruby 3.1.
References
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| rexml | < 3.3.9 |
3.3.9 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rexml RubyGems → 3.3.9
- bundler
bundle update rexml # Gemfile: gem "rexml", ">= 3.3.9"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Unreported
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-1333: Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How to prevent it
- Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
- System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
- Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- Implementation: Limit the length of the input that the regular expression will process.
References
Advisories
Packages
Other links
- github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
- github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-49761.yml
- lists.debian.org/debian-lts-announce/2025/01/msg00011.html
- security.netapp.com/advisory/ntap-20241227-0004
- ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
- access.redhat.com/errata/RHSA-2025:17606
- access.redhat.com/errata/RHSA-2025:17613
- access.redhat.com/errata/RHSA-2025:17693
- access.redhat.com/security/cve/CVE-2025-10990
- bugzilla.redhat.com/show_bug.cgi
- ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-c2f4-jgmc-q2r5 REXML has DoS condition when parsing malformed XML file | Medium | Also affects rexml |
| GHSA-vmwr-mc7x-5vc3 REXML denial of service vulnerability | Medium | Also affects rexml |
| GHSA-5866-49gr-22v4 REXML DoS vulnerability | High | Also affects rexml |
| GHSA-r55c-59qm-vjw6 REXML DoS vulnerability | High | Also affects rexml |
| GHSA-4xqq-m2hx-25v8 REXML denial of service vulnerability | Medium | Also affects rexml |
| GHSA-vg3r-rm7w-2xgh REXML contains a denial of service vulnerability | Medium | Also affects rexml |
| GHSA-8cr8-4vfw-mr7h REXML round-trip instability | High | Also affects rexml |
| GHSA-7wch-p9px-956x Forge: Regular expression denial of service in PEM decoding (pem.decode) | High | Same weakness, CWE-1333 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor