CVE-2024-39908 Denial of service in REXML

What is CVE-2024-39908?

CVE-2024-39908 is a medium-severity denial of service vulnerability in Netapp Bootstrap Os, published on 16 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.

Weakness: CWE-400

Which versions are affected by CVE-2024-39908?

2 open source packages ship an affected version, including rexml. It affects 2 products.

Products include Netapp Bootstrap Os, Ruby-Lang Rexml.

How do I fix CVE-2024-39908?

Upgrade rexml to 3.3.2 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-39908 being exploited?

There is no known exploitation of CVE-2024-39908 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Netapp Bootstrap Os

• CVE-2024-43398 REXML denial of service vulnerability Medium 5.9
• CVE-2025-30691 Security feature bypass in Oracle Java SE Medium 4.8
• CVE-2024-43790 heap-buffer-overflow in do_search() in Vim < 9.1.0689 Medium 4.5
• CVE-2025-29768 Vim vulnerable to potential data loss with zip.vim and special crafted zip files Medium 4.4
• CVE-2024-47814 use-after-free when closing buffers in Vim Low 3.9

All Netapp Bootstrap Os vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2024-39908, AZL-45429, AZL-45435, AZL-45439, AZL-45769, BELL-CVE-2024-39908 and 5 more.