High severity7.5NVD Advisory· Published Oct 28, 2024· Updated Jun 17, 2026
CVE-2024-49761
CVE-2024-49761
Description
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
rexmlRubyGems | < 3.3.9 | 3.3.9 |
Affected products
145- osv-coords144 versionspkg:apk/chainguard/jruby-9.4pkg:apk/chainguard/jruby-9.4-default-rubypkg:apk/chainguard/kube-fluentd-operatorpkg:apk/chainguard/kube-fluentd-operator-compatpkg:apk/chainguard/kube-fluentd-operator-default-configpkg:apk/chainguard/kube-fluentd-operator-oci-entrypointpkg:apk/chainguard/logstash-8pkg:apk/chainguard/logstash-8-bitnami-compatpkg:apk/chainguard/logstash-8-compatpkg:apk/chainguard/logstash-8-env2yamlpkg:apk/chainguard/logstash-8-iamguarded-compatpkg:apk/chainguard/logstash-8-with-output-opensearchpkg:apk/chainguard/logstash-jre-bcfipspkg:apk/chainguard/logstash-jre-bcfips-compatpkg:apk/chainguard/logstash-jre-bcfips-env2yamlpkg:apk/chainguard/logstash-jre-bcfips-with-output-opensearchpkg:apk/chainguard/ruby-3.1pkg:apk/chainguard/ruby-3.1-basepkg:apk/chainguard/ruby-3.1-base-devpkg:apk/chainguard/ruby-3.1-devpkg:apk/chainguard/ruby-3.1-docpkg:apk/chainguard/ruby3.1-fluentd-kubernetes-daemonset-1.16pkg:apk/chainguard/ruby3.1-fluentd-kubernetes-daemonset-1.16-kinesispkg:apk/chainguard/ruby3.1-fluentd-kubernetes-daemonset-1.17pkg:apk/chainguard/ruby3.1-fluentd-kubernetes-daemonset-1.17-kinesispkg:apk/chainguard/ruby-3.2pkg:apk/chainguard/ruby-3.2-basepkg:apk/chainguard/ruby-3.2-base-devpkg:apk/chainguard/ruby-3.2-devpkg:apk/chainguard/ruby-3.2-docpkg:apk/chainguard/ruby3.2-fluentd-kubernetes-daemonset-1.16pkg:apk/chainguard/ruby3.2-fluentd-kubernetes-daemonset-1.16-kinesispkg:apk/chainguard/ruby3.2-fluentd-kubernetes-daemonset-1.17pkg:apk/chainguard/ruby3.2-fluentd-kubernetes-daemonset-1.17-kinesispkg:apk/chainguard/ruby-3.3pkg:apk/chainguard/ruby-3.3-basepkg:apk/chainguard/ruby-3.3-base-devpkg:apk/chainguard/ruby-3.3-devpkg:apk/chainguard/ruby-3.3-docpkg:apk/chainguard/ruby3.3-fluentd-kubernetes-daemonset-1.16pkg:apk/chainguard/ruby3.3-fluentd-kubernetes-daemonset-1.16-kinesispkg:apk/chainguard/ruby3.3-fluentd-kubernetes-daemonset-1.17pkg:apk/chainguard/ruby3.3-fluentd-kubernetes-daemonset-1.17-kinesispkg:apk/chainguard/ruby3.4-fluentd-kubernetes-daemonset-1.16pkg:apk/chainguard/ruby3.4-fluentd-kubernetes-daemonset-1.16-kinesispkg:apk/chainguard/ruby3.4-fluentd-kubernetes-daemonset-1.17pkg:apk/chainguard/ruby3.4-fluentd-kubernetes-daemonset-1.17-kinesispkg:apk/wolfi/jruby-9.4pkg:apk/wolfi/jruby-9.4-default-rubypkg:apk/wolfi/kube-fluentd-operatorpkg:apk/wolfi/kube-fluentd-operator-compatpkg:apk/wolfi/kube-fluentd-operator-default-configpkg:apk/wolfi/kube-fluentd-operator-oci-entrypointpkg:apk/wolfi/logstash-8pkg:apk/wolfi/logstash-8-bitnami-compatpkg:apk/wolfi/logstash-8-compatpkg:apk/wolfi/logstash-8-env2yamlpkg:apk/wolfi/logstash-8-iamguarded-compatpkg:apk/wolfi/logstash-8-with-output-opensearchpkg:apk/wolfi/ruby-3.1pkg:apk/wolfi/ruby-3.1-basepkg:apk/wolfi/ruby-3.1-base-devpkg:apk/wolfi/ruby-3.1-devpkg:apk/wolfi/ruby-3.1-docpkg:apk/wolfi/ruby3.1-fluentd-kubernetes-daemonset-1.17pkg:apk/wolfi/ruby3.1-fluentd-kubernetes-daemonset-1.17-kinesispkg:apk/wolfi/ruby-3.2pkg:apk/wolfi/ruby-3.2-basepkg:apk/wolfi/ruby-3.2-base-devpkg:apk/wolfi/ruby-3.2-devpkg:apk/wolfi/ruby-3.2-docpkg:apk/wolfi/ruby3.2-fluentd-kubernetes-daemonset-1.17pkg:apk/wolfi/ruby3.2-fluentd-kubernetes-daemonset-1.17-kinesispkg:apk/wolfi/ruby-3.3pkg:apk/wolfi/ruby-3.3-basepkg:apk/wolfi/ruby-3.3-base-devpkg:apk/wolfi/ruby-3.3-devpkg:apk/wolfi/ruby-3.3-docpkg:apk/wolfi/ruby3.3-fluentd-kubernetes-daemonset-1.17pkg:apk/wolfi/ruby3.3-fluentd-kubernetes-daemonset-1.17-kinesispkg:apk/wolfi/ruby3.4-fluentd-kubernetes-daemonset-1.17pkg:apk/wolfi/ruby3.4-fluentd-kubernetes-daemonset-1.17-kinesispkg:gem/rexmlpkg:rpm/almalinux/pcspkg:rpm/almalinux/pcs-snmppkg:rpm/almalinux/rubypkg:rpm/almalinux/ruby-bundled-gemspkg:rpm/almalinux/ruby-default-gemspkg:rpm/almalinux/ruby-develpkg:rpm/almalinux/ruby-docpkg:rpm/almalinux/rubygem-abrtpkg:rpm/almalinux/rubygem-abrt-docpkg:rpm/almalinux/rubygem-bigdecimalpkg:rpm/almalinux/rubygem-bsonpkg:rpm/almalinux/rubygem-bson-docpkg:rpm/almalinux/rubygem-bundlerpkg:rpm/almalinux/rubygem-bundler-docpkg:rpm/almalinux/rubygem-did_you_meanpkg:rpm/almalinux/rubygem-io-consolepkg:rpm/almalinux/rubygem-irbpkg:rpm/almalinux/rubygem-jsonpkg:rpm/almalinux/rubygem-minitestpkg:rpm/almalinux/rubygem-mongopkg:rpm/almalinux/rubygem-mongo-docpkg:rpm/almalinux/rubygem-mysql2pkg:rpm/almalinux/rubygem-mysql2-docpkg:rpm/almalinux/rubygem-net-telnetpkg:rpm/almalinux/rubygem-opensslpkg:rpm/almalinux/rubygem-pgpkg:rpm/almalinux/rubygem-pg-docpkg:rpm/almalinux/rubygem-power_assertpkg:rpm/almalinux/rubygem-psychpkg:rpm/almalinux/rubygem-rakepkg:rpm/almalinux/rubygem-rbspkg:rpm/almalinux/rubygem-rdocpkg:rpm/almalinux/rubygem-rexmlpkg:rpm/almalinux/rubygem-rsspkg:rpm/almalinux/rubygemspkg:rpm/almalinux/rubygems-develpkg:rpm/almalinux/rubygem-test-unitpkg:rpm/almalinux/rubygem-typeprofpkg:rpm/almalinux/rubygem-xmlrpcpkg:rpm/almalinux/ruby-irbpkg:rpm/almalinux/ruby-libspkg:rpm/opensuse/ruby2.5&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/rubygem-rexml&distro=openSUSE%20Leap%2015.6pkg:rpm/rocky-linux/ruby?distro=rocky-linux-9&epoch=0pkg:rpm/suse/ruby2.5&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSSpkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/ruby2.5&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5pkg:rpm/suse/ruby2.5&distro=SUSE%20Manager%20Proxy%204.3pkg:rpm/suse/ruby2.5&distro=SUSE%20Manager%20Server%204.3pkg:rpm/suse/rubygem-rexml&distro=SUSE%20Package%20Hub%2015%20SP6
< 9.4.9.0-r0+ 143 more
- (no CPE)range: < 9.4.9.0-r0
- (no CPE)range: < 9.4.9.0-r0
- (no CPE)range: < 1.18.2-r18
- (no CPE)range: < 1.18.2-r18
- (no CPE)range: < 1.18.2-r18
- (no CPE)range: < 1.18.2-r18
- (no CPE)range: < 8.16.0-r1
- (no CPE)range: < 8.16.0-r1
- (no CPE)range: < 8.16.0-r1
- (no CPE)range: < 8.16.0-r1
- (no CPE)range: < 8.16.0-r1
- (no CPE)range: < 8.16.0-r1
- (no CPE)range: < 8.16.0-r0
- (no CPE)range: < 8.16.0-r0
- (no CPE)range: < 8.16.0-r0
- (no CPE)range: < 8.16.0-r0
- (no CPE)range: < 3.1.6-r6
- (no CPE)range: < 3.1.6-r6
- (no CPE)range: < 3.1.6-r6
- (no CPE)range: < 3.1.6-r6
- (no CPE)range: < 3.1.6-r6
- (no CPE)range: < 1.16.6.1.2-r1
- (no CPE)range: < 1.16.6.1.2-r1
- (no CPE)range: < 1.17.1.1.2-r2
- (no CPE)range: < 1.17.1.1.2-r2
- (no CPE)range: < 3.2.6-r0
- (no CPE)range: < 3.2.6-r0
- (no CPE)range: < 3.2.6-r0
- (no CPE)range: < 3.2.6-r0
- (no CPE)range: < 3.2.6-r0
- (no CPE)range: < 1.16.6.1.2-r2
- (no CPE)range: < 1.16.6.1.2-r2
- (no CPE)range: < 1.17.1.1.2-r1
- (no CPE)range: < 1.17.1.1.2-r1
- (no CPE)range: < 3.3.6-r0
- (no CPE)range: < 3.3.6-r0
- (no CPE)range: < 3.3.6-r0
- (no CPE)range: < 3.3.6-r0
- (no CPE)range: < 3.3.6-r0
- (no CPE)range: < 1.16.6.1.2-r2
- (no CPE)range: < 1.16.6.1.2-r2
- (no CPE)range: < 1.17.1.1.2-r2
- (no CPE)range: < 1.17.1.1.2-r2
- (no CPE)range: < 1.16.6.1.2-r2
- (no CPE)range: < 1.16.6.1.2-r2
- (no CPE)range: < 1.17.1.1.2-r2
- (no CPE)range: < 1.17.1.1.2-r2
- (no CPE)range: < 9.4.9.0-r0
- (no CPE)range: < 9.4.9.0-r0
- (no CPE)range: < 1.18.2-r18
- (no CPE)range: < 1.18.2-r18
- (no CPE)range: < 1.18.2-r18
- (no CPE)range: < 1.18.2-r18
- (no CPE)range: < 8.16.0-r1
- (no CPE)range: < 8.16.0-r1
- (no CPE)range: < 8.16.0-r1
- (no CPE)range: < 8.16.0-r1
- (no CPE)range: < 8.16.0-r1
- (no CPE)range: < 8.16.0-r1
- (no CPE)range: < 3.1.6-r6
- (no CPE)range: < 3.1.6-r6
- (no CPE)range: < 3.1.6-r6
- (no CPE)range: < 3.1.6-r6
- (no CPE)range: < 3.1.6-r6
- (no CPE)range: < 1.17.1.1.2-r2
- (no CPE)range: < 1.17.1.1.2-r2
- (no CPE)range: < 3.2.6-r0
- (no CPE)range: < 3.2.6-r0
- (no CPE)range: < 3.2.6-r0
- (no CPE)range: < 3.2.6-r0
- (no CPE)range: < 3.2.6-r0
- (no CPE)range: < 1.17.1.1.2-r1
- (no CPE)range: < 1.17.1.1.2-r1
- (no CPE)range: < 3.3.6-r0
- (no CPE)range: < 3.3.6-r0
- (no CPE)range: < 3.3.6-r0
- (no CPE)range: < 3.3.6-r0
- (no CPE)range: < 3.3.6-r0
- (no CPE)range: < 1.17.1.1.2-r1
- (no CPE)range: < 1.17.1.1.2-r1
- (no CPE)range: < 1.17.1.1.2-r2
- (no CPE)range: < 1.17.1.1.2-r2
- (no CPE)range: < 3.3.9
- (no CPE)range: < 0.10.18-2.el8_10.6.alma.1
- (no CPE)range: < 0.10.18-2.el8_10.6.alma.1
- (no CPE)range: < 3.1.5-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 3.1.5-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 3.1.5-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 3.1.5-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 3.1.5-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 0.4.0-1.module_el8.9.0+3746+91b8233a
- (no CPE)range: < 0.4.0-1.module_el8.10.0+3854+02eaa59a
- (no CPE)range: < 3.1.1-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 4.3.0-2.module_el8.5.0+2625+ec418553
- (no CPE)range: < 4.3.0-2.module_el8.5.0+2625+ec418553
- (no CPE)range: < 2.3.27-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 1.16.1-4.module_el8.5.0+2625+ec418553
- (no CPE)range: < 1.2.0-113.module_el8.10.0+3932+2d440da3
- (no CPE)range: < 0.5.11-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 1.4.1-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 2.6.1-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 5.15.0-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 2.5.1-2.module_el8.5.0+2625+ec418553
- (no CPE)range: < 2.5.1-2.module_el8.5.0+2625+ec418553
- (no CPE)range: < 0.5.3-3.module_el8.10.0+3854+02eaa59a
- (no CPE)range: < 0.5.3-3.module_el8.10.0+3854+02eaa59a
- (no CPE)range: < 0.1.1-113.module_el8.10.0+3932+2d440da3
- (no CPE)range: < 2.1.2-113.module_el8.10.0+3932+2d440da3
- (no CPE)range: < 1.3.2-1.module_el8.10.0+3854+02eaa59a
- (no CPE)range: < 1.3.2-1.module_el8.10.0+3854+02eaa59a
- (no CPE)range: < 2.0.1-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 4.0.4-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 13.0.6-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 2.7.0-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 6.4.1.1-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 3.2.5-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 0.2.9-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 3.3.27-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 3.3.27-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 3.5.3-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 0.21.3-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 0.3.0-113.module_el8.10.0+3932+2d440da3
- (no CPE)range: < 2.5.9-113.module_el8.10.0+3932+2d440da3
- (no CPE)range: < 3.1.5-144.module_el8.10.0+3933+43481280
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 3.3.9-bp156.4.3.1
- (no CPE)range: < 0:3.0.7-163.el9_5
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 2.5.9-150700.24.3.1
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 2.5.9-150000.4.36.1
- (no CPE)range: < 3.3.9-bp156.4.3.1
- ruby/rexmlv5Range: < 3.3.9
Patches
Vulnerability mechanics
References
9- github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979fnvdPatchWEB
- github.com/advisories/GHSA-2rxp-v6pw-ch6mghsaADVISORY
- github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6mnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-49761ghsaADVISORY
- security.netapp.com/advisory/ntap-20241227-0004/nvdThird Party Advisory
- www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761nvdVendor AdvisoryWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-49761.ymlghsaWEB
- lists.debian.org/debian-lts-announce/2025/01/msg00011.htmlnvdWEB
- security.netapp.com/advisory/ntap-20241227-0004ghsaWEB
News mentions
0No linked articles in our index yet.