CVE-2024-49761: ReDoS vulnerability in REXML

Posted by kou on 28 Oct 2024

There is a ReDoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier CVE-2024-49761. We strongly recommend upgrading the REXML gem.

This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.

Details

When parsing an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;).

Please update REXML gem to version 3.3.9 or later.

Affected versions

  • REXML gem 3.3.8 or prior with Ruby 3.1 or prior

Credits

Thanks to manun for discovering this issue.

History

  • Originally published at 2024-10-28 03:00:00 (UTC)