VYPR
← All advisories
Moderate severityNVD Advisory· Published Jul 16, 2024· Updated Nov 3, 2025

Denial of service in REXML

CVE-2024-39908

Description

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as <, 0 and %>. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

REXML gem before 3.3.1 has denial-of-service vulnerabilities when parsing XML with many specific characters, fixed in 3.3.2.

CVE-2024-39908 describes multiple denial-of-service (DoS) vulnerabilities in the REXML XML toolkit for Ruby, affecting versions prior to 3.3.1 [1]. The root cause involves inefficient handling of XML input containing a high volume of specific characters such as <, 0, and %>, which can lead to excessive resource consumption during parsing [1][4].

An attacker can exploit these vulnerabilities by providing a crafted XML document containing many of the problematic characters to an application that parses untrusted XML using REXML. No authentication or special network position is required beyond the ability to supply the malicious XML input, making the attack surface broad for services that accept user-supplied XML [1].

Successful exploitation could cause the parsing process to consume excessive CPU or memory, leading to a denial-of-service condition that may impact the availability of the affected service. The vulnerabilities do not appear to allow code execution or data exfiltration, as the impact is limited to resource exhaustion [1].

The REXML gem version 3.3.2 (and later) includes patches to address these DoS vulnerabilities. Users are strongly advised to upgrade to at least version 3.3.2 [1][4]. For those unable to upgrade, the only recommended mitigation is to avoid parsing untrusted XML strings entirely [1].

References
  1. NVD - CVE-2024-39908
  2. Release REXML 3.3.2 - 2024-07-16 · ruby/rexml

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rexmlRubyGems
< 3.3.23.3.2

Affected products

126

Patches

1
2b285ac0804f
https://github.com/ruby/rexmlvia osv
commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.