CVE Feed

    Dashboard / CVE / CVE-2024-49761

    CVE-2024-49761

    REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

    Published:Oct 28, 2024
    Last Modified:Nov 3, 2025
    EPS:Oct 28, 2024
    EPSS Score:0.00383
    CVSS Score:7.5

    Affected Products

    Vendor
    Netapp
    Product
    Ontap Tools
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Rhel Aus
    Vendor
    Redhat
    Product
    Rhel E4s
    Vendor
    Redhat
    Product
    Rhel Eus
    Vendor
    Redhat
    Product
    Rhel Tus
    Vendor
    Ruby
    Product
    Rexml
    Vendor
    Ruby-lang
    Product
    Rexml
    Vendor
    Ruby-lang
    Product
    Ruby

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-492 Regular Expression Exponential Blowup

    Related CVEs

    CVE-2025-27820 (CVSS 7.5) — A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management a…
    CVE-2025-0167 (CVSS 3.4) — When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the passwo…
    CVE-2024-52533 (CVSS 9.8) — gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because …
    CVE-2024-38286 (CVSS 8.6) — Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apach…
    CVE-2024-7254 (CVSS 8.7) — Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / seri…
    CVE-2024-8096 (CVSS 6.5) — When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to …
    CVE-2024-6119 (CVSS 7.5) — Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates…
    CVE-2024-39884 (CVSS 6.2) — A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based config…
    CVE-2024-39689 (CVSS 7.5) — Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates wh…
    CVE-2024-34750 (CVSS 7.5) — Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High