CVE-2025-10990CWE-1333

Rexml: rexml: denial of service via inefficient regex parsing

High · published February 27, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00497 · 41.8th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2026-02-27T13:32Z
EPSS history
Timeline
  • 27 FEB 13:32Z
    Rexml: rexml: denial of service via inefficient regex parsing
    cvelistv5