CVE-2024-41946

5.3 MEDIUM

Published: August 01, 2024 Modified: November 03, 2025

Description

REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368

Source: security-advisories@github.com

Patch

https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4

Source: security-advisories@github.com

Vendor Advisory

https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml

Source: security-advisories@github.com

Not Applicable

https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946

Source: security-advisories@github.com

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20250117-0007/

Source: af854a3a-2127-422b-91ae-364da2661108

6 reference(s) from NVD

Quick Stats

CVSS v3 Score

5.3 / 10.0

EPSS (Exploit Probability)

0.7%

71th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-400 CWE-400

Affected Vendors

ruby-lang

Related CVEs