Ruby: CVE-2024-49761: ReDoS vulnerability in REXML

[NewsBot]

A new Ruby blog post/announcement has been posted!

There is a ReDoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier CVE-2024-49761. We strongly recommend upgrading the REXML gem.

This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.

Details

When parsing an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;).

Please update REXML gem to version 3.3.9 or later.

Affected versions

• REXML gem 3.3.8 or prior with Ruby 3.1 or prior

Credits

Thanks to manun for discovering this issue.

History

• ...

Get the full details here: CVE-2024-49761: ReDoS vulnerability in REXML