CVE-2008-3790

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 15.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-08-27 · updated 2026-06-16
Weakness: CWE-20

Description

The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."

Affected products

Ruby: 1.8.6, 1.8.6-p110, 1.8.6-p111, 1.8.6-p114, 1.8.6-p230, 1.8.6-p286 (+15)

References

http://groups.google.com/group/comp.lang.ruby/browse_thread/thread/19f69e8a081fc0d1/e138e014b74352ca
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://secunia.com/advisories/31602
http://secunia.com/advisories/32165
http://secunia.com/advisories/32219
http://secunia.com/advisories/32255
http://secunia.com/advisories/32256
http://secunia.com/advisories/32371
http://secunia.com/advisories/33178
http://secunia.com/advisories/33185
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200812-17.xml

Get alerted when CVE-2008-3790 or the next vulnerability affects your stack