Logo
›
›vulnerability›CVE-2024-35176
Name
CVE-2024-35176
Source
NVD ( link)Debian ( link)
Description
REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
CWEs
CWE-400
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfbPatch
https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xghVendor Advisory
https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176Vendor Advisory
https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfbPatch
https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xghVendor Advisory
https://security.netapp.com/advisory/ntap-20250306-0001/Third Party Advisory
https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176Vendor Advisory

Analysis#

Affected Component
Analysis
ruby
Patched

Vulnerability Ratings#

5.3
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
ruby
buildroot
2025.02.x
3.4.9
Not Affected
ruby
buildroot
master
4.0.3
Not Affected
ruby
openwrt
master
4.0.2-r1
Not Affected
ruby
openwrt
openwrt-25.12
3.4.9-r1
Not Affected
ruby
yocto
master
4.0.5
Not Affected
ruby
yocto
scarthgap
3.3.10
Not Affected

Resolved with patches#

ruby (yocto:kirkstone)

#
Title
Author
Resolve
1
Read quoted attributes in chunks (#126)
Nobuyoshi Nakada <nobu@ruby-lang.org>
CVE-2024-35176