<p>There is a DoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier <a href="https://www.cve.org/CVERecord?id=CVE-2024-43398">CVE-2024-43398</a>. We strongly recommend upgrading the REXML gem.</p>

<h2>Details</h2>

<p>When parsing an XML that has many deep elements that have same local name attributes, REXML gem may take long time.</p>

<p>It’s only affected with the tree parser API. If you’re using <code class="language-plaintext highlighter-rouge">REXML::Document.new</code> to parse an XML, you may be affected.</p>

<p>Please update REXML gem to version 3.3.6 or later.</p>

<h2>Affected versions</h2>

<ul>
  <li>REXML gem 3.3.5 or prior</li>
</ul>

<h2>Credits</h2>

<p>Thanks to <a href="https://hackerone.com/l33thaxor">l33thaxor</a> for discovering this issue.</p>

<h2>History</h2>

<ul>
  <li>Originally published at 2024-08-22 03:00:00 (UTC)</li>
</ul>

<p>Posted by kou on 22 Aug 2024</p>

CVE-2024-43398: DoS vulnerability in REXML

Details

Affected versions

Credits

History

ArticlesYou might like