{"id":"CVE-2024-41123","published":"2024-08-01T14:18:43Z","modified":"2025-11-03T20:38:32Z","title":"REXML DoS vulnerability","vendor":"ruby","product":"rexml","tier":"tail","description":{"text":"REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01283,"percentile":0.69979,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8","tags":["x_refsource_MISC"]},{"url":"https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh","tags":["x_refsource_MISC"]},{"url":"https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20241227-0005/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html","tags":[]}],"priority":{"score":17.7,"factors":[{"name":"EPSS percentile","points":14.0},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"ruby","affectedVersions":[{"vendor":"ruby","product":"rexml","versions":["< 3.3.3"]}],"affected":[{"ecosystem":"RubyGems","package":"rexml","vulnerableRanges":["<3.3.3"],"patched":["3.3.3"],"from":["GHSA-r55c-59qm-vjw6"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2644","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ruby-rexml-cve-2024-35176","parents":[{"from":"CVE-2024-35176","to":"CVE-2024-41123","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-vg3r-rm7w-2xgh","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-r55c-59qm-vjw6","via":"reference","url":"https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh"}]},{"from":"CVE-2024-39908","to":"CVE-2024-41123","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-4xqq-m2hx-25v8","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-r55c-59qm-vjw6","via":"reference","url":"https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8"},{"kind":"version-step","provenance":"source","package":"RubyGems:rexml","fromFixed":"3.3.2","toFixed":"3.3.3","daysApart":16},{"kind":"similar","provenance":"machine","score":0.23,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2021-28965","published":"2021-04-21","fixed":"3.2.5","kev":false},{"cve":"CVE-2024-35176","published":"2024-05-16","fixed":"3.2.7","kev":false},{"cve":"CVE-2024-39908","published":"2024-07-16","fixed":"3.3.2","kev":false},{"cve":"CVE-2024-41123","published":"2024-08-01","fixed":"3.3.3","kev":false},{"cve":"CVE-2024-41946","published":"2024-08-01","fixed":"3.3.3","kev":false},{"cve":"CVE-2024-43398","published":"2024-08-22","fixed":"3.3.6","kev":false},{"cve":"CVE-2024-49761","published":"2024-10-28","fixed":"3.3.9","kev":false}],"package":"RubyGems:rexml"}}