CVE-2024-41946

Katalog CVE

CVSS 7.5 · High EPSS 1,2%

Kerentanan Uncontrolled Resource Consumption pada ruby-lang rexml. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.

Rincian

Terbit di NVD

1 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4 advisory vendor
• https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946 advisory vendor
• https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368 patch
• https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml not applicable
• https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html
• https://security.netapp.com/advisory/ntap-20250117-0007/