CVE-2025-10990: Rexml: rexml: denial of service via inefficient regex parsing

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-27 · updated 2026-06-26
Weakness: CWE-1333

Description

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

Affected products

Red Hat Satellite 6.16 for RHEL 8: all versions — fixed in 0:8.8.1-3.el8sat
Red Hat Satellite 6.16 for RHEL 9: all versions — fixed in 0:8.8.1-3.el9sat
Red Hat Satellite 6.17 for RHEL 9: all versions — fixed in 0:8.8.1-3.el9sat
Red Hat Satellite Client 6 for RHEL 8: all versions — fixed in 0:7.34.0-4.el8sat
Red Hat Satellite Client 6 for RHEL 9: all versions — fixed in 0:7.34.0-4.el9sat

How to fix

Upgrade to a fixed version: Red Hat Satellite 6.16 for RHEL 8 0:8.8.1-3.el8sat; Red Hat Satellite 6.16 for RHEL 9 0:8.8.1-3.el9sat; Red Hat Satellite 6.17 for RHEL 9 0:8.8.1-3.el9sat; Red Hat Satellite Client 6 for RHEL 8 0:7.34.0-4.el8sat; Red Hat Satellite Client 6 for RHEL 9 0:7.34.0-4.el9sat. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-10990 or the next vulnerability affects your stack