VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 1, 2024· Updated Nov 3, 2025

REXML DoS vulnerability

CVE-2024-41123

Description

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, >] and ]>. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

REXML gem before 3.3.2 has Denial of Service vulnerabilities when parsing XML with many specific characters like whitespace, '>]', and ']>'.

Vulnerability

Description

CVE-2024-41123 affects the REXML gem for Ruby, an XML toolkit used for parsing and manipulating XML documents. The vulnerability is a Denial of Service (DoS) issue present in versions prior to 3.3.2. The root cause lies in the XML parser's handling of certain character sequences; when parsing XML that contains a high volume of specific characters such as whitespace characters, >], or ]>, the parser can become overwhelmed, leading to excessive resource consumption [1][4].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted XML document containing a large number of the problematic character sequences to an application that uses REXML for parsing. The attack does not require authentication if the application accepts untrusted XML input. The malicious XML can be delivered through various vectors, such as file uploads, API requests, or any other means of XML data ingestion [4].

Impact

Successful exploitation results in a Denial of Service condition, where the application may become unresponsive or crash due to high CPU or memory usage. This can disrupt availability for legitimate users. The impact is limited to availability; there is no evidence of data leakage or remote code execution [1][4].

Mitigation

The vulnerability is fixed in REXML gem version 3.3.3 or later. Users are advised to update to the patched version immediately. The Ruby project also recommends avoiding parsing untrusted XML as a workaround if an immediate update is not possible [4]. The related issues are tracked under GHSA-4xqq-m2hx-25v8 and GHSA-vg3r-rm7w-2xgh [4].

References
  1. NVD - CVE-2024-41123
  2. DoS vulnerabilities in REXML

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rexmlRubyGems
< 3.3.33.3.3

Affected products

126

Patches

1
e4a067e11235

Add 3.3.3 entry

https://github.com/ruby/rexmlSutou KouheiAug 1, 2024via osv
commit
1 file changed · +34 −0
  • NEWS.md+34 −0 modified
    @@ -1,5 +1,39 @@
 # News
 
+## 3.3.3 - 2024-08-01 {#version-3-3-3}
+
+### Improvements
+
+  * Added support for detecting invalid XML that has unsupported
+    content before root element
+    * GH-184
+    * Patch by NAITOH Jun.
+
+  * Added support for `REXML::Security.entity_expansion_limit=` and
+    `REXML::Security.entity_expansion_text_limit=` in SAX2 and pull
+    parsers
+    * GH-187
+    * Patch by NAITOH Jun.
+
+  * Added more tests for invalid XMLs.
+    * GH-183
+    * Patch by Watson.
+
+  * Added more performance tests.
+    * Patch by Watson.
+
+  * Improved parse performance.
+    * GH-186
+    * Patch by tomoya ishida.
+
+### Thanks
+
+  * NAITOH Jun
+
+  * Watson
+
+  * tomoya ishida
+
 ## 3.3.2 - 2024-07-16 {#version-3-3-2}
 
 ### Improvements

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.