VYPR
← All advisories
High severityNVD Advisory· Published Aug 22, 2024· Updated Nov 3, 2025

REXML denial of service vulnerability

CVE-2024-43398

Description

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

REXML gem before 3.3.6 has a denial-of-service vulnerability via XML with many deep elements sharing local name attributes when using tree parser API.

Vulnerability

Description

The REXML gem for Ruby, versions prior to 3.3.6, contains a denial-of-service (DoS) vulnerability triggered during parsing of specially crafted XML documents. The issue occurs in the tree parser API (e.g., REXML::Document.new) when the input XML contains deeply nested elements that share the same local name attributes [1][2]. The parsing process becomes excessively slow due to an inefficient check for conflicting namespaces, leading to a denial-of-service condition.

Attack

Vector and Exploitation

An attacker can craft an XML payload with numerous deep elements having identical local name attributes. When a vulnerable application uses the tree parser API to parse untrusted XML, the parsing operation consumes excessive CPU resources, effectively causing a denial of service [1]. The vulnerability does not affect stream parser API or SAX2 parser API [1]. No authentication is required; the attacker only needs to provide the malicious XML to the parsing routine.

Impact

Successful exploitation results in high CPU consumption, potentially rendering the affected service unresponsive or causing a complete denial of service. The impact is limited to availability; there is no evidence of data leakage or code execution.

Mitigation

The vulnerability is fixed in REXML gem version 3.3.6 and later [1][2]. Users are advised to upgrade immediately. If upgrading is not possible, applications can mitigate by using alternative parser APIs (stream or SAX2) that are not affected [1].

References
  1. NVD - CVE-2024-43398
  2. parser tree: improve namespace conflicted attribute check performance · ruby/rexml@7cb5eae

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
rexmlRubyGems
< 3.3.63.3.6

Affected products

128

Patches

1
7cb5eaeb221c

parser tree: improve namespace conflicted attribute check performance

https://github.com/ruby/rexmlSutou KouheiAug 17, 2024via ghsa
commit
4 files changed · +33 −11
  • lib/rexml/element.rb+0 −11 modified
    @@ -2384,17 +2384,6 @@ def []=( name, value )
       elsif old_attr.kind_of? Hash
         old_attr[value.prefix] = value
       elsif old_attr.prefix != value.prefix
-        # Check for conflicting namespaces
-        if value.prefix != "xmlns" and old_attr.prefix != "xmlns"
-          old_namespace = old_attr.namespace
-          new_namespace = value.namespace
-          if old_namespace == new_namespace
-            raise ParseException.new(
-                    "Namespace conflict in adding attribute \"#{value.name}\": "+
-                    "Prefix \"#{old_attr.prefix}\" = \"#{old_namespace}\" and "+
-                    "prefix \"#{value.prefix}\" = \"#{new_namespace}\"")
-          end
-        end
         store value.name, {old_attr.prefix => old_attr,
                            value.prefix    => value}
       else
  • lib/rexml/parsers/baseparser.rb+15 −0 modified
    @@ -754,6 +754,7 @@ def process_instruction
 
       def parse_attributes(prefixes)
         attributes = {}
+        expanded_names = {}
         closed = false
         while true
           if @source.match(">", true)
@@ -805,6 +806,20 @@ def parse_attributes(prefixes)
               raise REXML::ParseException.new(msg, @source, self)
             end
 
+            unless prefix == "xmlns"
+              uri = @namespaces[prefix]
+              expanded_name = [uri, local_part]
+              existing_prefix = expanded_names[expanded_name]
+              if existing_prefix
+                message = "Namespace conflict in adding attribute " +
+                          "\"#{local_part}\": " +
+                          "Prefix \"#{existing_prefix}\" = \"#{uri}\" and " +
+                          "prefix \"#{prefix}\" = \"#{uri}\""
+                raise REXML::ParseException.new(message, @source, self)
+              end
+              expanded_names[expanded_name] = prefix
+            end
+
             attributes[name] = value
           else
             message = "Invalid attribute name: <#{@source.buffer.split(%r{[/>\s]}).first}>"
  • test/parse/test_element.rb+14 −0 modified
    @@ -131,5 +131,19 @@ def test_linear_performance_attribute_value_gt
         REXML::Document.new('<test testing="' + ">" * n + '"></test>')
       end
     end
+
+    def test_linear_performance_deep_same_name_attributes
+      seq = [100, 500, 1000, 1500, 2000]
+      assert_linear_performance(seq, rehearsal: 10) do |n|
+        xml = <<-XML
+<?xml version="1.0"?>
+<root xmlns:ns="ns-uri">
+#{"<x ns:name='ns-value' name='value'>\n" * n}
+#{"</x>\n" * n}
+</root>
+        XML
+        REXML::Document.new(xml)
+      end
+    end
   end
 end
  • test/test_core.rb+4 −0 modified
    @@ -136,6 +136,10 @@ def test_attribute_namespace_conflict
       # https://www.w3.org/TR/xml-names/#uniqAttrs
       message = <<-MESSAGE.chomp
 Namespace conflict in adding attribute "a": Prefix "n1" = "http://www.w3.org" and prefix "n2" = "http://www.w3.org"
+Line: 4
+Position: 140
+Last 80 unconsumed characters:
+/>
       MESSAGE
       assert_raise(REXML::ParseException.new(message)) do
         Document.new(<<-XML)

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.