CVE-2024-41946: ruby-lang rexml Uncontrolled Resource Consumption
CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2024-41946UBUNTU-CVE-2024-41946DEBIAN-CVE-2024-41946CGA-2fc5-m922-66fmCGA-4489-qf46-ggw8CGA-4qvx-5c82-7g5cCGA-528m-8g9m-rg73CGA-59x8-rhxw-qcm7CGA-5fcq-92hr-ffq5CGA-5fvh-c32x-wvgcCGA-65xq-6jqx-mr6qCGA-7xp8-gjwg-jgwgCGA-898c-mw29-cvw3CGA-9h4j-hm4g-h4f7CGA-f3vh-pc3r-6fh6CGA-g2hq-9v9v-q3p3CGA-h633-3fp6-63ppCGA-h7pr-m54m-g5rvCGA-h9wc-xm92-xwwcCGA-hcg2-phpg-2jffCGA-hm9r-mrj5-88vqCGA-j74q-g5rm-pxxfCGA-jp27-wfhq-f6j4CGA-jp7x-c3hw-m947CGA-jv5p-ggcp-q86jCGA-m3jh-c658-9w8hCGA-p325-644w-q7xcCGA-p456-qchx-9fwwCGA-p497-v5hg-c8fhCGA-p84m-rqmp-59vqCGA-pxmh-p2wr-8m74CGA-v74w-927h-9cx3CGA-vc28-5mmf-hxfrCGA-vjcv-hpj7-qc22CGA-wf69-jx5h-p4mxCGA-2xw2-vp7g-mcfwCGA-6c76-rxmr-w9mgCGA-78qr-2fp2-cj5gCGA-7hpg-8g7w-5v7vCGA-965p-3cr3-f562CGA-c5m7-v4gw-8vf4CGA-hjh2-r9h7-72vpCGA-jprv-7mqr-xcphGHSA-5866-49gr-22v4CGA-q25f-qm28-w5h9CGA-qxpc-ccwr-5rjgCGA-vf95-h6jj-6hfmCGA-vp3q-8386-7rwfCGA-w5v9-93f6-7vppCGA-w8cm-2p77-m3vjCGA-wf4x-r6q7-fgrwCGA-wfhf-q79p-4jcpCGA-xrr5-4837-r2mrCGA-xrv6-r4h3-j4q3
Published 01-08-2024Last modified 03-11-2025
Vulnerability summary
CVE-2024-41946 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in ruby-lang rexml. EPSS estimates a 1.19% chance of exploitation in the next 30 days, higher than 67.5% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
1.19%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 14 · Related 21DLA-4018-1MGASA-2025-0001OPENSUSE-SU-2025:0129-1RHSA-2024:6670RHSA-2024:6702RHSA-2024:6703RHSA-2024:6784RHSA-2024:6785RHSA-2025:4063RHSA-2025:4488SUSE-SU-2024:3874-1USN-7091-1USN-7091-2USN-7840-1CGA-25J3-FHHC-5WR2CGA-3XR5-PWX9-QCH9CGA-58GC-R4XX-4MMWCGA-8722-4V4G-8VJRCGA-96H6-X8G9-47FVCGA-9V7F-2QJ3-XV9FCGA-C6PQ-8CFX-9P4VCGA-CQP7-RQ6Q-883WCGA-CRVW-4882-W64XCGA-F7F8-M26X-GX78CGA-FGQG-JCQ9-JV3QCGA-M9MR-7FP9-MVH3CGA-Q9F2-M4XR-H5PCCGA-V98J-MCMH-G897CGA-VH8V-W8JP-44VQCGA-W364-9XG9-2VMF
Timeline
- 01-08-2024PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
CVSS metrics
9 scores · 8 sources · 2 versionsMedium 6.9Preferred score · OSV · Rubygems (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NSourcesSingle source
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources8 sources · 5.3–7.5
- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · RubygemsEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.19%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
0.00 pp
From 1.19% on 18-09-2026
18-09-202618-10-2026
EPSS score1.19%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard25 products
- jruby-9.4< 9.4.9.0-r0
- jruby-9.4-default-ruby< 9.4.9.0-r0
- kube-fluentd-operator< 1.18.2-r14
- kube-fluentd-operator-compat< 1.18.2-r14
- kube-fluentd-operator-default-config< 1.18.2-r14
Wolfi16 products
- jruby-9.4< 9.4.9.0-r0
- jruby-9.4-default-ruby< 9.4.9.0-r0
- kube-fluentd-operator< 1.18.2-r14
- kube-fluentd-operator-compat< 1.18.2-r14
- kube-fluentd-operator-default-config< 1.18.2-r14
Ubuntu6 products
- jrubyAll versions (No fix recorded)
- ruby2.3< 2.3.1-2~ubuntu16.04.16+esm11
- ruby2.5< 2.5.1-1ubuntu1.16+esm6
- ruby2.7< 2.7.0-5ubuntu1.15
- ruby3.0< 3.0.2-7ubuntu2.8
Debian2 products
- ruby3.1All versions (No fix recorded)
- ruby3.3< 3.3.5-1
Alpine1 product
- ruby-rexml< 3.3.9-r0
Ruby1 product
- rexml< 3.3.3
Ruby-lang1 product
- rexml< 3.3.3
RubyGems1 product
- rexml< 3.3.3
8 vendors · 53 products
References
18 links- github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4X Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
- github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368X Refsource MISCREPORTFIXWEBPatch
Show all 18 references
- github.com/ruby/rexmlPACKAGE