CVSS 4.0
6.6 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UCVE-2024-49761
Medium (6.6). EPSS 1.4% chance of exploitation in the next 30 days. Fixed in rexml 3.3.9.
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
Severity
CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1333
- Published
- Modified
- Record from
- the NVD, synced
Affected
- netapp:ontap_tools
- ruby-lang:rexml
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2rxp-v6pw-ch6m | RubyGems | rexml | <3.3.9 | 3.3.9 |
References
- https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
- https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
- https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
- https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html
- https://security.netapp.com/advisory/ntap-20241227-0004/