CVE-2024-49761: REXML ReDoS vulnerability
(updated )
The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;).
This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.
References
- github.com/advisories/GHSA-2rxp-v6pw-ch6m
- github.com/ruby/rexml
- github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
- github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-49761.yml
- lists.debian.org/debian-lts-announce/2025/01/msg00011.html
- nvd.nist.gov/vuln/detail/CVE-2024-49761
- security.netapp.com/advisory/ntap-20241227-0004
- www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
Code Behaviors & Features
Detect and mitigate CVE-2024-49761 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →