rexml Gem up to 3.3.5 on Ruby API Parser REXML::Document.new xml entity expansion

Summaryinfo

A vulnerability identified as problematic has been detected in rexml Gem up to 3.3.5 on Ruby. Affected is the function REXML::Document.new of the component API Parser. Performing a manipulation results in xml entity expansion. This vulnerability is identified as CVE-2024-43398. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in rexml Gem up to 3.3.5 on Ruby. This affects the function REXML::Document.new of the component API Parser. The manipulation with an unknown input leads to a xml entity expansion vulnerability. CWE is classifying the issue as CWE-776. The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities. This is going to have an impact on availability. The summary by CVE is:

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-43398 since 08/12/2024. The exploitability is told to be difficult. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 207950 (Rocky Linux 8 : ruby:3.3 (RLSA-2024:6784)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.3.6 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (207950) and CERT Bund (WID-SEC-2025-2475). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Apple macOS

Productinfo

Type

• Ruby Gem

Name

• rexml Gem

Version

• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.3.5

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion