CVE-2024-43398 REXML denial of service vulnerability
Attackers can cause denial of service in Ruby applications by parsing untrusted XML with deep elements using the tree parser API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-43398?
CVE-2024-43398 is a medium-severity denial of service vulnerability in Netapp Bootstrap Os, published on 22 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability.
Weakness: CWE-776
Which versions are affected by CVE-2024-43398?
2 open source packages ship an affected version, including rexml. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
rexml RubyGems | All versions | 3.3.6 |
rexml RubyGems | All versions | 3.3.6 |
Products include Netapp Bootstrap Os, Ruby-Lang Rexml.
How do I fix CVE-2024-43398?
Upgrade rexml to 3.3.6 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-43398 being exploited?
There is no known exploitation of CVE-2024-43398 in the wild and no public exploit code.
Other vulnerabilities in Netapp Bootstrap Os
- CVE-2025-30691 Security feature bypass in Oracle Java SE
- CVE-2024-43790 heap-buffer-overflow in do_search() in Vim < 9.1.0689
- CVE-2025-29768 Vim vulnerable to potential data loss with zip.vim and special crafted zip files
- CVE-2024-39908 Denial of service in REXML
- CVE-2024-47814 use-after-free when closing buffers in Vim
Sources
Also known as ALPINE-CVE-2024-43398, AZL-48150, AZL-48154, AZL-48156, AZL-48162, DEBIAN-CVE-2024-43398 and 5 more.