REXML Gem Vulnerable to ReDoS Attack

CVE-2024-49761

What is CVE-2024-49761?

The REXML XML toolkit for Ruby has a ReDoS (Regular Expression Denial of Service) vulnerability present in versions prior to 3.3.9. This vulnerability is triggered when REXML processes XML inputs containing numerous digits positioned between '&#' and 'x...' within hex numeric character references (e.g., '&#x...;'). While later Ruby versions, specifically Ruby 3.2 and above, remain unaffected, Ruby 3.1 is identified as the only maintained version susceptible to this flaw. The REXML gem has addressed this security issue in version 3.3.9 and subsequent releases, making it crucial for developers utilizing earlier versions to upgrade promptly to mitigate potential risks.

References