CVE-2024-41123

Katalog CVE

CVSS 7.5 · High EPSS 1,3%

Kerentanan Uncontrolled Resource Consumption pada ruby-lang rexml. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.

Rincian

Terbit di NVD

1 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6 advisory vendor
• https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123 advisory vendor
• https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8 not applicable
• https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh not applicable
• https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html
• https://security.netapp.com/advisory/ntap-20241227-0005/