<p>There are some DoS vulnerabilities in REXML gem. These vulnerabilities have been assigned the CVE identifier <a href="https://www.cve.org/CVERecord?id=CVE-2024-41123">CVE-2024-41123</a>. We strongly recommend upgrading the REXML gem.</p>

<h2>Details</h2>

<p>When parsing an XML document that has many specific characters such as whitespace character, <code class="language-plaintext highlighter-rouge">&gt;]</code> and <code class="language-plaintext highlighter-rouge">]&gt;</code>, REXML gem may take long time.</p>

<p>Please update REXML gem to version 3.3.3 or later.</p>

<h2>Affected versions</h2>

<ul>
  <li>REXML gem 3.3.2 or prior</li>
</ul>

<h2>Credits</h2>

<p>Thanks to <a href="https://hackerone.com/mprogrammer">mprogrammer</a> and <a href="https://hackerone.com/scyoon">scyoon</a> for discovering these issues.</p>

<h2>History</h2>

<ul>
  <li>Originally published at 2024-08-01 03:00:00 (UTC)</li>
</ul>

<p>Posted by kou on 1 Aug 2024</p>

CVE-2024-41123: DoS vulnerabilities in REXML

Details

Affected versions

Credits

History

ArticlesYou might like