CVE-2024-49761: REXML ReDoS vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-28 · updated 2026-06-17
Weakness: CWE-1333

Description

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

Affected products

NetApp Ontap Tools: 10
ruby rexml: before 3.3.9 — fixed in 3.3.9

How to fix

Upgrade to a fixed version: ruby rexml 3.3.9. Check the vendor advisory for mitigations.

References

https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761
https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html
https://security.netapp.com/advisory/ntap-20241227-0004/

Get alerted when CVE-2024-49761 or the next vulnerability affects your stack