Posted by kou on 22 Aug 2024
There is a DoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier CVE-2024-43398. We strongly recommend upgrading the REXML gem.
Details
When parsing an XML that has many deep elements that have same local name attributes, REXML gem may take long time.
It’s only affected with the tree parser API. If you’re using REXML::Document.new to parse an XML, you may be affected.
Please update REXML gem to version 3.3.6 or later.
Affected versions
- REXML gem 3.3.5 or prior
Credits
Thanks to l33thaxor for discovering this issue.
History
- Originally published at 2024-08-22 03:00:00 (UTC)