CVE-2024-41946CWE-400

REXML DoS vulnerability

Medium · published August 1, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
67.8
In the wild
Unconfirmed
What it is

REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01192 · 67.8th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2024-08-01T14:22Z
EPSS history
Timeline
  • 01 AUG 14:22Z
    REXML DoS vulnerability
    cvelistv5