CVE-2025-10990 Rexml: rexml: denial of service via inefficient regex parsing
Remote attackers can cause denial of service in REXML via inefficient regex parsing of hex numeric character references in XML documents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-10990?
CVE-2025-10990 is a high-severity denial of service vulnerability in Red Hat Satellite 6.16 for RHEL 8, published on 27 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
Weakness: CWE-1333
Which versions are affected by CVE-2025-10990?
Linux distribution packages (2)
puppet-agent Red Hat:rhel_satellite_client:6::el8 | All versions | 0:7.34.0-4.el8sat |
puppet-agent Red Hat:rhel_satellite_client:6::el9 | All versions | 0:7.34.0-4.el9sat |
How do I fix CVE-2025-10990?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-10990 being exploited?
There is no known exploitation of CVE-2025-10990 in the wild and no public exploit code.
Sources
Also known as GHSA-qg2f-7w4r-25f2, RHSA-2025:17693, UBUNTU-CVE-2025-10990.