QwikSec

Security Database

CVE

CWE

Training

CVE-2024-41123

Published: Aug 1, 2024

Modified: Nov 3, 2025

PUBLISHED

CVSS v3.1

5.3

MEDIUM

Description

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.

Vendor	Product	Versions
ruby	rexml	affected `< 3.3.3`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

References

https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6

x_refsource_CONFIRM

https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8

x_refsource_MISC

https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh

x_refsource_MISC

https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.