CVE-2024-49761
published 2024-10-28CVE-2024-49761: REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.43%
70.1th percentile
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos_sequoia | — | — |
| apple | macos_sonoma | — | — |
| apple | macos_tahoe | — | — |
| debian | ruby2.7 | < ruby2.7 2.7.4-1+deb11u3 (bullseye) | ruby2.7 2.7.4-1+deb11u3 (bullseye) |
| debian | ruby3.1 | < ruby2.7 2.7.4-1+deb11u3 (bullseye) | ruby2.7 2.7.4-1+deb11u3 (bullseye) |
| debian | ruby3.3 | < ruby2.7 2.7.4-1+deb11u3 (bullseye) | ruby2.7 2.7.4-1+deb11u3 (bullseye) |
| msrc | azl3_ruby_3.3.5-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_ruby_3.3.5-3_on_azure_linux_3.0 | — | — |
| msrc | azl3_rubygem-rexml_3.3.9-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_rubygem-rexml_3.3.9-2_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_ruby_3.1.4-8_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_ruby_3.1.4-9_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_rubygem-rexml_3.2.7-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_rubygem-rexml_3.2.7-4_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| netapp | ontap_tools | — | — |
| ruby-lang | rexml | < 3.3.9 | 3.3.9 |
| ruby-lang | rexml | >= 0 < 3.3.9 | 3.3.9 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.06.6MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.6MEDIUM
vendor_msrc7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian6.6MEDIUM
vendor_redhat6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qg2f-7w4r-25f2: A flaw was found in REXML
ghsa_unreviewed·2026-02-27·CVSS 6.6
CVE-2025-10990 [MEDIUM] CWE-1333 GHSA-qg2f-7w4r-25f2: A flaw was found in REXML
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
OSV
CVE-2025-10990: A flaw was found in REXML
osv·2026-02-27·CVSS 6.6
CVE-2025-10990 [MEDIUM] CVE-2025-10990: A flaw was found in REXML
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
OSV
ruby2.3, ruby2.5 vulnerabilities
osv·2025-04-17·CVSS 6.6
CVE-2025-27219 [MEDIUM] ruby2.3, ruby2.5 vulnerabilities
ruby2.3, ruby2.5 vulnerabilities
It was discovered that the Ruby CGI gem incorrectly handled parsing certain
cookies. A remote attacker could possibly use this issue to consume
resources, leading to a denial of service. (CVE-2025-27219)
It was discovered that the Ruby CGI gem incorrectly handled parsing certain
regular expressions. A remote attacker could possibly use this issue to
consume resources, leading to a denial of service. (CVE-2025-27220)
It was discovered that the Ruby URI gem incorrectly handled certain URI
handling methods. A remote attacker could possibly use this issue to leak
authentication credentials. (CVE-2025-27221)
It was discovered that the Ruby REXML gem incorrectly handled parsing XML
documents containing many digits in a hex numeric character reference. A
remot
OSV
ruby2.7 vulnerabilities
osv·2024-11-21·CVSS 5.3
CVE-2024-35176 [MEDIUM] ruby2.7 vulnerabilities
ruby2.7 vulnerabilities
USN-7091-1 fixed several vulnerabilities in Ruby. This update provides the
corresponding update for CVE-2024-35176, CVE-2024-41123, CVE-2024-41946 and
CVE-2024-49761 for ruby2.7 in Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that Ruby incorrectly handled parsing of an XML document
that has specific XML characters in an attribute value using REXML gem. An
attacker could use this issue to cause Ruby to crash, resulting in a
denial of service. This issue only affected in Ubuntu 22.04 LTS and Ubuntu
24.04 LTS. (CVE-2024-35176, CVE-2024-39908, CVE-2024-41123)
It was discovered that Ruby incorrectly handled parsing of an XML document
that has many entity expansions with SAX2 or pull parser API. An attacker
could use this issue to cause Ruby to crash
OSV
ruby3.0, ruby3.2, ruby3.3 vulnerabilities
osv·2024-11-05·CVSS 5.3
CVE-2024-35176 [MEDIUM] ruby3.0, ruby3.2, ruby3.3 vulnerabilities
ruby3.0, ruby3.2, ruby3.3 vulnerabilities
It was discovered that Ruby incorrectly handled parsing of an XML document
that has specific XML characters in an attribute value using REXML gem. An
attacker could use this issue to cause Ruby to crash, resulting in a denial
of service. This issue only affected in Ubuntu 22.04 LTS and Ubuntu 24.04
LTS. (CVE-2024-35176, CVE-2024-39908, CVE-2024-41123)
It was discovered that Ruby incorrectly handled parsing of an XML document
that has many entity expansions with SAX2 or pull parser API. An attacker
could use this issue to cause Ruby to crash, resulting in a denial of
service. (CVE-2024-41946)
It was discovered that Ruby incorrectly handled parsing of an XML document
that has many digits in a hex numeric character reference. An attacker
could use
OSV
REXML ReDoS vulnerability
osv·2024-10-28
CVE-2024-49761 [MEDIUM] REXML ReDoS vulnerability
REXML ReDoS vulnerability
### Impact
The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between `&#` and `x...;` in a hex numeric character reference (`&#x...;`).
This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.
### Patches
The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
### Workarounds
Use Ruby 3.2 or later instead of Ruby 3.1.
### References
* https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org
GHSA
REXML ReDoS vulnerability
ghsa·2024-10-28
CVE-2024-49761 [MEDIUM] CWE-1333 REXML ReDoS vulnerability
REXML ReDoS vulnerability
### Impact
The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between `&#` and `x...;` in a hex numeric character reference (`&#x...;`).
This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.
### Patches
The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
### Workarounds
Use Ruby 3.2 or later instead of Ruby 3.1.
### References
* https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org
OSV
CVE-2024-49761: REXML is an XML toolkit for Ruby
osv·2024-10-28·CVSS 6.6
CVE-2024-49761 [MEDIUM] CVE-2024-49761: REXML is an XML toolkit for Ruby
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
Apple
CVE-2024-49761: macOS Sequoia 15.7.2
vendor_apple·2025-11-03·CVSS 6.6
CVE-2024-49761 [MEDIUM] CVE-2024-49761: macOS Sequoia 15.7.2
Apple Security Update: About the security content of macOS Sequoia 15.7.2
Product: macOS Sequoia
Version: 15.7.2
CVE: CVE-2024-49761
Component: CVE-2024-49761
Apple
CVE-2024-49761: macOS Sonoma 14.8.2
vendor_apple·2025-11-03·CVSS 6.6
CVE-2024-49761 [MEDIUM] CVE-2024-49761: macOS Sonoma 14.8.2
Apple Security Update: About the security content of macOS Sonoma 14.8.2
Product: macOS Sonoma
Version: 14.8.2
CVE: CVE-2024-49761
Component: CVE-2024-49761
Apple
CVE-2024-49761: macOS Tahoe 26.1
vendor_apple·2025-11-03·CVSS 6.6
CVE-2024-49761 [MEDIUM] CVE-2024-49761: macOS Tahoe 26.1
Apple Security Update: About the security content of macOS Tahoe 26.1
Product: macOS Tahoe
Version: 26.1
CVE: CVE-2024-49761
Component: CVE-2024-49761
Red Hat
rexml: REXML: Denial of Service via inefficient regex parsing
vendor_redhat·2025-09-25·CVSS 6.6
CVE-2025-10990 [MEDIUM] CWE-1333 rexml: REXML: Denial of Service via inefficient regex parsing
rexml: REXML: Denial of Service via inefficient regex parsing
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-497
Ubuntu
Ruby vulnerabilities
vendor_ubuntu·2025-04-17·CVSS 7.5
CVE-2025-27220 [HIGH] Ruby vulnerabilities
Title: Ruby vulnerabilities
Summary: Several security issues were fixed in Ruby.
It was discovered that the Ruby CGI gem incorrectly handled parsing certain
cookies. A remote attacker could possibly use this issue to consume
resources, leading to a denial of service. (CVE-2025-27219)
It was discovered that the Ruby CGI gem incorrectly handled parsing certain
regular expressions. A remote attacker could possibly use this issue to
consume resources, leading to a denial of service. (CVE-2025-27220)
It was discovered that the Ruby URI gem incorrectly handled certain URI
handling methods. A remote attacker could possibly use this issue to leak
authentication credentials. (CVE-2025-27221)
It was discovered that the Ruby REXML gem incorrectly handled parsing XML
documents containing many dig
Ubuntu
Ruby vulnerabilities
vendor_ubuntu·2024-11-21·CVSS 5.3
CVE-2024-35176 [MEDIUM] Ruby vulnerabilities
Title: Ruby vulnerabilities
Summary: Several security issues were fixed in Ruby.
USN-7091-1 fixed several vulnerabilities in Ruby. This update provides the
corresponding update for CVE-2024-35176, CVE-2024-41123, CVE-2024-41946 and
CVE-2024-49761 for ruby2.7 in Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that Ruby incorrectly handled parsing of an XML document
that has specific XML characters in an attribute value using REXML gem. An
attacker could use this issue to cause Ruby to crash, resulting in a
denial of service. This issue only affected in Ubuntu 22.04 LTS and Ubuntu
24.04 LTS. (CVE-2024-35176, CVE-2024-39908, CVE-2024-41123)
It was discovered that Ruby incorrectly handled parsing of an XML document
that has many entity expansions with SAX2 or pull parser AP
Ubuntu
Ruby vulnerabilities
vendor_ubuntu·2024-11-05·CVSS 5.3
CVE-2024-35176 [MEDIUM] Ruby vulnerabilities
Title: Ruby vulnerabilities
Summary: Several security issues were fixed in Ruby.
It was discovered that Ruby incorrectly handled parsing of an XML document
that has specific XML characters in an attribute value using REXML gem. An
attacker could use this issue to cause Ruby to crash, resulting in a denial
of service. This issue only affected in Ubuntu 22.04 LTS and Ubuntu 24.04
LTS. (CVE-2024-35176, CVE-2024-39908, CVE-2024-41123)
It was discovered that Ruby incorrectly handled parsing of an XML document
that has many entity expansions with SAX2 or pull parser API. An attacker
could use this issue to cause Ruby to crash, resulting in a denial of
service. (CVE-2024-41946)
It was discovered that Ruby incorrectly handled parsing of an XML document
that has many digits in a hex numeric cha
Red Hat
rexml: REXML ReDoS vulnerability
vendor_redhat·2024-10-28·CVSS 6.6
CVE-2024-49761 [MEDIUM] CWE-1333 rexml: REXML ReDoS vulnerability
rexml: REXML ReDoS vulnerability
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
A flaw was found in the ReXML XML toolkit for Ruby. Parsing XML data containing a large number of digits between `&# `and `x...;` in a hex numeric character reference (`&#x...;`) can trigger a regular expression denial of service (ReDoS) condition, leading to a denial of service.
Statement: This vulnerability is rated as a moderate severity because it allows attackers to exploit inefficient regex
Microsoft
REXML ReDoS vulnerability
vendor_msrc·2024-10-08·CVSS 7.5
CVE-2024-49761 [MEDIUM] CWE-1333 REXML ReDoS vulnerability
REXML ReDoS vulnerability
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azu
Debian
CVE-2024-49761: ruby2.7 - REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnera...
vendor_debian·2024·CVSS 6.6
CVE-2024-49761 [MEDIUM] CVE-2024-49761: ruby2.7 - REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnera...
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
Scope: local
bullseye: resolved (fixed in 2.7.4-1+deb11u3)
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-10990 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.6
CVE-2025-10990 [MEDIUM] CVE-2025-10990 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-10990 :
Ruby Interpreter vulnerability analysis and mitigation
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
Source : NVD
## 7.5
Score
Published February 27, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
Ruby Interpreter
Linux Ubuntu
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 36.8
Exploitation Probability (EPSS) 0.2
Affected packages and l
HackerOne
CVE-2024-49761: ReDoS vulnerability in REXML
hackerone·2024-11-30·CVSS 7.5
CVE-2024-49761 [HIGH] CVE-2024-49761: ReDoS vulnerability in REXML
CVE-2024-49761: ReDoS vulnerability in REXML
Hi,
When [REXML](https://github.com/ruby/rexml) is used to parse an XML that has many digits between `&#` and `x...;` in a hex numeric character reference `(&#x...;)` may lead to ReDos.
Advisory: https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/
## Impact
Reduced performance or Denial of Service was possible where REXML is used to parse user input.
###CVE-2024-49761: ReDoS vulnerability in REXML
There is a ReDoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier CVE-2024-49761. We strongly recommend upgrading the REXML gem.
This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.
###Details
When parsing
https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979fhttps://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6mhttps://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761https://lists.debian.org/debian-lts-announce/2025/01/msg00011.htmlhttps://security.netapp.com/advisory/ntap-20241227-0004/
2024-10-28
Published