AZL-48154 CVE-2024-43398 affecting package rubygem-rexml for versions less than 3.2.9-1

🗓️ 22 Aug 2024 15:15:16Reported by GoogleType

osv🔗 osv.dev👁 2 Views

rubygem-rexml older than 3.2.9-1 suffers DoS from deeply nested XML with duplicate local names via the tree parser; fixed in 3.3.6.

Reporter	Title	Published	Views	Family All 208
IBM Security Bulletins	Security Bulletin: IBM Software Support mobile app is vulnerable to multiple vulnerabilities due to 3rd party software	27 Feb 202519:51	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in XML toolkit for Ruby affects IBM License Metric Tool.	17 Sep 202408:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in rexml	24 Oct 202422:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to Improper Restriction of Recursive Entity References due to rexml package ( CVE-2024-43398 )	17 Jun 202508:03	–	ibm
Tenable Nessus	Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2025-921)	1 Apr 202500:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0183: pcs (ALINUX3-SA-2024:0183)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : pcs (ALSA-2024:6670)	17 Sep 202400:00	–	nessus
Tenable Nessus	AlmaLinux 8 : ruby:3.3 (ALSA-2024:6784)	20 Sep 202400:00	–	nessus
Tenable Nessus	AlmaLinux 9 : ruby:3.3 (ALSA-2024:6785)	20 Sep 202400:00	–	nessus
Tenable Nessus	AlmaLinux 9 : ruby:3.1 (ALSA-2025:4488)	8 May 202500:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-43398

21 Apr 2026 04:31Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.15.9

EPSS0.01167

SSVC