4.3

CVE-2024-39908: netapp bootstrap_os Uncontrolled Resource Consumption

CVSS: 4.3v3.1MediumModified
AliasesALPINE-CVE-2024-39908UBUNTU-CVE-2024-39908DEBIAN-CVE-2024-39908
Published 16-07-2024Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2024-39908 is a medium (CVSS 4.3) Uncontrolled Resource Consumption vulnerability in netapp bootstrap_os. EPSS estimates a 1.49% chance of exploitation in the next 30 days, higher than 73.7% of scored vulnerabilities.

Overall risk
17/100
0100
Low · default modelHow is this calculated?
CVSS score
4.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.49%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 12 · Related 24
DLA-4018-1MGASA-2025-0001OPENSUSE-SU-2025:0129-1RHSA-2024:6784RHSA-2024:6785RHSA-2025:4063

Timeline

  1. 16-07-2024
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.

CVSS metrics

9 scores · 8 sources · 2 versions

EPSS trend

Probability

1.49%

Chance of exploitation in the next 30 days

Percentile

74%

Versus all other CVEs

30-day change

0.00 pp

From 1.49% on 20-09-2026

20-09-202620-10-2026
EPSS score
1.49%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard26 products
  • jruby-9.4< 9.4.9.0-r0
  • jruby-9.4-default-ruby< 9.4.9.0-r0
  • kube-fluentd-operator< 1.18.2-r13
  • kube-fluentd-operator-compat< 1.18.2-r13
  • kube-fluentd-operator-default-config< 1.18.2-r13
Wolfi17 products
  • jruby-9.4< 9.4.9.0-r0
  • jruby-9.4-default-ruby< 9.4.9.0-r0
  • kube-fluentd-operator< 1.18.2-r13
  • kube-fluentd-operator-compat< 1.18.2-r13
  • kube-fluentd-operator-default-config< 1.18.2-r13
Ubuntu6 products
  • jrubyAll versions (No fix recorded)
  • ruby2.3< 2.3.1-2~ubuntu16.04.16+esm11
  • ruby2.5< 2.5.1-1ubuntu1.16+esm6
  • ruby2.7< 2.7.0-5ubuntu1.16
  • ruby3.0< 3.0.2-7ubuntu2.10
Debian2 products
  • ruby3.1All versions (No fix recorded)
  • ruby3.3< 3.3.5-1
Alpine1 product
  • ruby-rexml< 3.3.9-r0
Netapp1 product
Ruby1 product
Ruby-lang1 product
RubyGems1 product
  • rexml< 3.3.2

9 vendors · 56 products

References

18 links
Show all 18 references