CVE-2024-49761 REXML ReDoS vulnerability
An attacker can cause a denial of service in applications using the REXML library by sending crafted XML with excessive digits in hex numeric character references.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49761?
CVE-2024-49761 is a medium-severity denial of service vulnerability in ruby rexml, published on 28 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
Weakness: CWE-1333
Which versions are affected by CVE-2024-49761?
It affects 2 products.
Linux distribution packages (40)
pcs AlmaLinux:8 | All versions | 0.10.18-2.el8_10.6.alma.1 |
pcs-snmp AlmaLinux:8 | All versions | 0.10.18-2.el8_10.6.alma.1 |
ruby AlmaLinux:8 | All versions | 2.5.9-113.module_el8.10.0+3932+2d440da3 |
ruby AlmaLinux:8 | All versions | 3.1.5-144.module_el8.10.0+3933+43481280 |
ruby-bundled-gems AlmaLinux:8 | All versions | 3.1.5-144.module_el8.10.0+3933+43481280 |
ruby-default-gems AlmaLinux:8 | All versions | 3.1.5-144.module_el8.10.0+3933+43481280 |
ruby-devel AlmaLinux:8 | All versions | 2.5.9-113.module_el8.10.0+3932+2d440da3 |
ruby-devel AlmaLinux:8 | All versions | 3.1.5-144.module_el8.10.0+3933+43481280 |
ruby-doc AlmaLinux:8 | All versions | 2.5.9-113.module_el8.10.0+3932+2d440da3 |
ruby-doc AlmaLinux:8 | All versions | 3.1.5-144.module_el8.10.0+3933+43481280 |
ruby-irb AlmaLinux:8 | All versions | 2.5.9-113.module_el8.10.0+3932+2d440da3 |
ruby-libs AlmaLinux:8 | All versions | 2.5.9-113.module_el8.10.0+3932+2d440da3 |
ruby-libs AlmaLinux:8 | All versions | 3.1.5-144.module_el8.10.0+3933+43481280 |
rubygem-abrt AlmaLinux:8 | All versions | 0.3.0-4.module_el8.5.0+2625+ec418553 |
rubygem-abrt AlmaLinux:8 | All versions | 0.4.0-1.module_el8.9.0+3746+91b8233a |
rubygem-abrt-doc AlmaLinux:8 | All versions | 0.3.0-4.module_el8.5.0+2623+08a8ba32 |
rubygem-abrt-doc AlmaLinux:8 | All versions | 0.4.0-1.module_el8.10.0+3854+02eaa59a |
rubygem-bigdecimal AlmaLinux:8 | All versions | 1.3.4-113.module_el8.10.0+3932+2d440da3 |
rubygem-bigdecimal AlmaLinux:8 | All versions | 3.1.1-144.module_el8.10.0+3933+43481280 |
rubygem-bson AlmaLinux:8 | All versions | 4.3.0-2.module_el8.5.0+259+8cec6917 |
rubygem-bson AlmaLinux:8 | All versions | 4.3.0-2.module_el8.5.0+2625+ec418553 |
rubygem-bson AlmaLinux:8 | All versions | 4.3.0-2.module_el8.6.0+3170+4b08f9d4 |
rubygem-bson-doc AlmaLinux:8 | All versions | 4.3.0-2.module_el8.5.0+2625+ec418553 |
rubygem-bundler AlmaLinux:8 | All versions | 1.16.1-4.module_el8.10.0+3871+342e2c2f |
rubygem-bundler AlmaLinux:8 | All versions | 2.3.27-144.module_el8.10.0+3933+43481280 |
rubygem-bundler-doc AlmaLinux:8 | All versions | 1.16.1-4.module_el8.5.0+2625+ec418553 |
rubygem-did_you_mean AlmaLinux:8 | All versions | 1.2.0-113.module_el8.10.0+3932+2d440da3 |
rubygem-io-console AlmaLinux:8 | All versions | 0.4.6-113.module_el8.10.0+3932+2d440da3 |
rubygem-io-console AlmaLinux:8 | All versions | 0.5.11-144.module_el8.10.0+3933+43481280 |
rubygem-irb AlmaLinux:8 | All versions | 1.4.1-144.module_el8.10.0+3933+43481280 |
rubygem-json AlmaLinux:8 | All versions | 2.1.0-113.module_el8.10.0+3932+2d440da3 |
rubygem-json AlmaLinux:8 | All versions | 2.6.1-144.module_el8.10.0+3933+43481280 |
rubygem-minitest AlmaLinux:8 | All versions | 5.10.3-113.module_el8.10.0+3932+2d440da3 |
rubygem-minitest AlmaLinux:8 | All versions | 5.15.0-144.module_el8.10.0+3933+43481280 |
rubygem-mongo AlmaLinux:8 | All versions | 2.5.1-2.module_el8.5.0+2625+ec418553 |
rubygem-mongo-doc AlmaLinux:8 | All versions | 2.5.1-2.module_el8.5.0+2625+ec418553 |
rubygem-mysql2 AlmaLinux:8 | All versions | 0.4.10-4.module_el8.5.0+259+8cec6917 |
rubygem-mysql2 AlmaLinux:8 | All versions | 0.4.10-4.module_el8.5.0+2625+ec418553 |
rubygem-mysql2 AlmaLinux:8 | All versions | 0.4.10-4.module_el8.6.0+3170+4b08f9d4 |
rubygem-mysql2 AlmaLinux:8 | All versions | 0.5.3-3.module_el8.10.0+3854+02eaa59a |
Products include Netapp Ontap Tools, Ruby-Lang Rexml.
How do I fix CVE-2024-49761?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-49761 being exploited?
There is no known exploitation of CVE-2024-49761 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2024-49761, ALSA-2024:10834, ALSA-2024:10850, ALSA-2024:10858, ALSA-2024:10860, ALSA-2025:11047 and 37 more.