DoS vulnerabilities in REXML

There is a DoS vulnerability in REXML gem.
This vulnerability has been assigned the CVE identifier
CVE-2024-41946. We strongly recommend upgrading the REXML gem.

Details

When parsing an XML that has many entity expansions with SAX2 or
pull parser API, REXML gem may take long time.

Please update REXML gem to version 3.3.3 or later.

Affected versions

• REXML gem 3.3.2 or prior

Credits

Thanks to NAITOH Jun for discovering and fixing this issue.

History

Originally published at 2024-08-01 03:00:00 (UTC)