CVE Feed

    Dashboard / CVE / CVE-2025-10990

    CVE-2025-10990

    A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

    Published:Sep 25, 2025
    Last Modified:Jun 25, 2026
    EPS:Feb 27, 2026
    EPSS Score:0.00417
    CVSS Score:7.5

    Affected Products

    Vendor
    Redhat
    Product
    Rhel Satellite Client
    Vendor
    Redhat
    Product
    Satellite
    Vendor
    Redhat
    Product
    Satellite Capsule
    Vendor
    Redhat
    Product
    Satellite Utils

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-492 Regular Expression Exponential Blowup

    Related CVEs

    CVE-2024-45336 (CVSS 6.1) — The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.c…
    CVE-2024-9355 (CVSS 6.5) — A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an unini…
    CVE-2023-38545 (CVSS 9.8) — This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass a…
    CVE-2023-38546 (CVSS 3.7) — This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific s…
    CVE-2023-39325 (CVSS 7.5) — A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive serve…
    CVE-2023-44487 (CVSS 7.5) — The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can …
    CVE-2022-41717 (CVSS 5.3) — An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connecti…
    CVE-2022-2068 (CVSS 7.3) — In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where t…
    CVE-2022-1292 (CVSS 7.3) — The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High