Denial of Service Vulnerability in REXML XML Toolkit for Ruby

CVE-2024-43398

What is CVE-2024-43398?

The REXML gem, a common XML toolkit for Ruby, contains a vulnerability that may lead to Denial of Service (DoS) when processing XML documents with deeply nested elements sharing the same local name attributes. Users who parse untrusted XML data through the tree parser API, such as REXML::Document.new, could potentially face disruption and service outages. Products implementing other parsing methodologies, like stream or SAX2 parser APIs, remain unaffected. Version 3.3.6 of the REXML gem includes essential patches to alleviate this risk. It is crucial for developers to update to the patched version to ensure protection against this vulnerability.

References