CVE-2024-35176 REXML contains a denial of service vulnerability

2024-05-1615:13:25

CWE-400

CWE-770

GitHub_M

github.com

rexml

denial of service

vulnerability

cve-2024-35176

xml toolkit

ruby

untrusted xmls

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

5.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.6%

JSON

REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many <s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don’t parse untrusted XMLs.

CNA Affected

[
  {
    "vendor": "ruby",
    "product": "rexml",
    "versions": [
      {
        "version": "< 3.2.7",
        "status": "affected"
      }
    ]
  }
]