Read the docs
TI-2024-33228 Aliases CVE-2024-49761GHSA-2rxp-v6pw-ch6m

REXML ReDoS vulnerability

Priority LOW 38CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 30 fixed, 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0142 72nd percentileScored 2026-11-07
Fix Partial rexml (ruby): 3.3.9rexml (RubyGems): 3.3.9Red Hat: 22 advisoriesRed Hat: 30 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rubyrexmlbefore 3.3.93.3.9Patch availableCNA
—rexml (RubyGems)before 3.3.93.3.9Patch availableGHSA-2rxp-v6pw-ch6m
  • rexml Vendorruby Affected before 3.3.9 Fixed in 3.3.9 Patch available CNA
  • rexml (RubyGems) Vendor— Affected before 3.3.9 Fixed in 3.3.9 Patch available GHSA-2rxp-v6pw-ch6m

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*before 3.3.9Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*before 3.2.0Running onruby
cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*10VulnerableNetApp
  • cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:* Versions before 3.3.9 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* Versions before 3.2.0 Running on ·ruby
  • cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:* Versions 10 Vulnerable ·NetApp

Remediation

  • Fix · CNA rexml (ruby) Fixed in 3.3.9
  • Fix · GHSA-2rxp-v6pw-ch6m rexml (RubyGems) Fixed in 3.3.9 Advisory →

Red Hat 22 advisories

  • RHSA-2025:17614 Released 2025-10-08 · Red Hat rating Important
    Satellite 6.15.5.5 Async Update
    • Red Hat Satellite 6.15 for RHEL 8 cjson-1.7.18-2.el8sat, puppet-agent-7.34.0-4.el8sat, python-django-4.2.24-0.1.el8pc +1
  • RHSA-2025:15371 Released 2025-09-04 · Red Hat rating Moderate
    Satellite 6 Client Bug Fix Update
    • Satellite Client 6 for RHEL 8 puppet-agent-7.34.0-3.el8sat
    • Satellite Client 6 for RHEL 9 puppet-agent-7.34.0-3.el9sat
  • RHSA-2025:15124 Released 2025-09-03 · Red Hat rating Moderate
    Satellite 6.16.5.3 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 puppet-agent-8.8.1-2.el8sat, puppetserver-8.6.2-3.el8sat, rubygem-foreman_rh_cloud-10.0.7-1.el8sat +5
    • Red Hat Satellite 6.16 for RHEL 9 puppet-agent-8.8.1-2.el9sat, puppetserver-8.6.2-3.el9sat, rubygem-foreman_rh_cloud-10.0.7-1.el9sat +5
Show 19 more Red Hat advisories
  • RHSA-2025:13269 Released 2025-08-07 · Red Hat rating Moderate
    Satellite 6.17.3 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 puppet-agent-8.8.1-2.el9sat, puppetserver-8.6.2-3.el9sat
  • RHSA-2025:13307 Released 2025-08-07 · Red Hat rating Moderate
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) pcs-0.10.12-6.el8_6.9, pcs-snmp-0.10.12-6.el8_6.9
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) pcs-0.10.12-6.el8_6.9, pcs-snmp-0.10.12-6.el8_6.9
  • RHSA-2025:12499 Released 2025-08-01 · Red Hat rating Moderate
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) pcs-0.10.15-4.el8_8.8, pcs-snmp-0.10.15-4.el8_8.8
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) pcs-0.10.15-4.el8_8.8, pcs-snmp-0.10.15-4.el8_8.8
  • RHSA-2025:11047 Released 2025-07-15 · Red Hat rating Moderate
    pcs security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) pcs-0.10.18-2.el8_10.6, pcs-snmp-0.10.18-2.el8_10.6
    • Red Hat Enterprise Linux ResilientStorage (v. 8) pcs-0.10.18-2.el8_10.6, pcs-snmp-0.10.18-2.el8_10.6
  • RHSA-2024:11029 Released 2024-12-12 · Red Hat rating Important
    ruby:2.5 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) ruby-2.5.9-111.module+el8.6.0+22644+99a75427.i686::ruby:2.5, ruby-2.5.9-111.module+el8.6.0+22644+99a75427.src::ruby:2.5, ruby-2.5.9-111.module+el8.6.0+22644+99a75427.x86_64::ruby:2.5 +44
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) ruby-2.5.9-111.module+el8.6.0+22644+99a75427.aarch64::ruby:2.5, ruby-2.5.9-111.module+el8.6.0+22644+99a75427.i686::ruby:2.5, ruby-2.5.9-111.module+el8.6.0+22644+99a75427.ppc64le::ruby:2.5 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) ruby-2.5.9-111.module+el8.6.0+22644+99a75427.i686::ruby:2.5, ruby-2.5.9-111.module+el8.6.0+22644+99a75427.src::ruby:2.5, ruby-2.5.9-111.module+el8.6.0+22644+99a75427.x86_64::ruby:2.5 +44
  • RHSA-2024:11028 Released 2024-12-12 · Red Hat rating Important
    ruby:2.5 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) ruby-2.5.9-108.module+el8.4.0+22645+8a608fad.i686::ruby:2.5, ruby-2.5.9-108.module+el8.4.0+22645+8a608fad.src::ruby:2.5, ruby-2.5.9-108.module+el8.4.0+22645+8a608fad.x86_64::ruby:2.5 +44
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) ruby-2.5.9-108.module+el8.4.0+22645+8a608fad.i686::ruby:2.5, ruby-2.5.9-108.module+el8.4.0+22645+8a608fad.ppc64le::ruby:2.5, ruby-2.5.9-108.module+el8.4.0+22645+8a608fad.src::ruby:2.5 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) ruby-2.5.9-108.module+el8.4.0+22645+8a608fad.i686::ruby:2.5, ruby-2.5.9-108.module+el8.4.0+22645+8a608fad.src::ruby:2.5, ruby-2.5.9-108.module+el8.4.0+22645+8a608fad.x86_64::ruby:2.5 +44
  • RHSA-2024:11027 Released 2024-12-12 · Red Hat rating Important
    ruby:2.5 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) ruby-2.5.5-106.module+el8.2.0+22646+0b11b626.i686::ruby:2.5, ruby-2.5.5-106.module+el8.2.0+22646+0b11b626.src::ruby:2.5, ruby-2.5.5-106.module+el8.2.0+22646+0b11b626.x86_64::ruby:2.5 +44
  • RHSA-2024:11001 Released 2024-12-12 · Red Hat rating Important
    ruby:2.5 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) ruby-2.5.9-111.module+el8.8.0+22642+d0d7978a.aarch64::ruby:2.5, ruby-2.5.9-111.module+el8.8.0+22642+d0d7978a.i686::ruby:2.5, ruby-2.5.9-111.module+el8.8.0+22642+d0d7978a.ppc64le::ruby:2.5 +47
  • RHSA-2024:10984 Released 2024-12-12 · Red Hat rating Important
    ruby:3.1 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) ruby-3.1.5-145.module+el9.4.0+22626+a031549d.aarch64::ruby:3.1, ruby-3.1.5-145.module+el9.4.0+22626+a031549d.i686::ruby:3.1, ruby-3.1.5-145.module+el9.4.0+22626+a031549d.ppc64le::ruby:3.1 +47
  • RHSA-2024:10982 Released 2024-12-12 · Red Hat rating Important
    ruby:3.1 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) ruby-3.1.2-141.1.module+el9.2.0+22640+f1bd3602.aarch64::ruby:3.1, ruby-3.1.2-141.1.module+el9.2.0+22640+f1bd3602.i686::ruby:3.1, ruby-3.1.2-141.1.module+el9.2.0+22640+f1bd3602.ppc64le::ruby:3.1 +47
  • RHSA-2024:10977 Released 2024-12-12 · Red Hat rating Important
    ruby security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) ruby-3.0.4-160.1.el9_0, ruby-default-gems-3.0.4-160.1.el9_0, ruby-devel-3.0.4-160.1.el9_0 +18
  • RHSA-2024:10966 Released 2024-12-11 · Red Hat rating Important
    ruby:3.1 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) ruby-3.1.2-142.module+el8.8.0+22637+76cde83a.aarch64::ruby:3.1, ruby-3.1.2-142.module+el8.8.0+22637+76cde83a.i686::ruby:3.1, ruby-3.1.2-142.module+el8.8.0+22637+76cde83a.ppc64le::ruby:3.1 +47
  • RHSA-2024:10964 Released 2024-12-11 · Red Hat rating Important
    ruby security update
    • Red Hat CodeReady Linux Builder EUS (v.9.2) ruby-doc-3.0.4-161.el9_2.2
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) ruby-3.0.4-161.el9_2.2, ruby-default-gems-3.0.4-161.el9_2.2, ruby-devel-3.0.4-161.el9_2.2 +18
  • RHSA-2024:10961 Released 2024-12-11 · Red Hat rating Important
    ruby security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) ruby-doc-3.0.7-162.el9_4.1
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) ruby-3.0.7-162.el9_4.1, ruby-default-gems-3.0.7-162.el9_4.1, ruby-devel-3.0.7-162.el9_4.1 +18
  • RHSA-2024:10860 Released 2024-12-05 · Red Hat rating Important
    ruby:3.1 security update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-3.1.5-145.module+el9.5.0+22579+d0aa0a16.aarch64::ruby:3.1, ruby-3.1.5-145.module+el9.5.0+22579+d0aa0a16.i686::ruby:3.1, ruby-3.1.5-145.module+el9.5.0+22579+d0aa0a16.ppc64le::ruby:3.1 +47
  • RHSA-2024:10858 Released 2024-12-05 · Red Hat rating Important
    ruby security update
    • Red Hat CodeReady Linux Builder (v. 9) ruby-doc-3.0.7-163.el9_5
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-3.0.7-163.el9_5, ruby-default-gems-3.0.7-163.el9_5, ruby-devel-3.0.7-163.el9_5 +18
  • RHSA-2024:10850 Released 2024-12-05 · Red Hat rating Important
    ruby:2.5 security update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-2.5.9-113.module+el8.10.0+22581+23fc9c9e.aarch64::ruby:2.5, ruby-2.5.9-113.module+el8.10.0+22581+23fc9c9e.i686::ruby:2.5, ruby-2.5.9-113.module+el8.10.0+22581+23fc9c9e.ppc64le::ruby:2.5 +47
  • RHSA-2024:10834 Released 2024-12-05 · Red Hat rating Important
    ruby:3.1 security update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-3.1.5-144.module+el8.10.0+22580+b97d9670.aarch64::ruby:3.1, ruby-3.1.5-144.module+el8.10.0+22580+b97d9670.i686::ruby:3.1, ruby-3.1.5-144.module+el8.10.0+22580+b97d9670.ppc64le::ruby:3.1 +47
  • RHSA-2024:10777 Released 2024-12-04 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.9.0) pcs-0.11.1-10.el9_0.6, pcs-snmp-0.11.1-10.el9_0.6
    • Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) pcs-0.11.1-10.el9_0.6, pcs-snmp-0.11.1-10.el9_0.6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2024:10858
Red Hat CodeReady Linux Builder EUS (v.9.2)Fixed RHSA-2024:10964
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2024:10961
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:10834, RHSA-2024:10850
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:10858, RHSA-2024:10860
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2024:11027
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:11028
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2024:11029
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:11028
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2024:11029
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2024:10977
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:10966, RHSA-2024:11001
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:10964, RHSA-2024:10982
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2024:10961, RHSA-2024:10984
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:11028
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2024:11029
Red Hat Enterprise Linux High Availability E4S (v.8.6)Fixed RHSA-2025:13307
Red Hat Enterprise Linux High Availability E4S (v.8.8)Fixed RHSA-2025:12499
Red Hat Enterprise Linux High Availability E4S (v.9.0)Fixed RHSA-2024:10777
Red Hat Enterprise Linux High Availability TUS (v.8.6)Fixed RHSA-2025:13307
Red Hat Enterprise Linux High Availability TUS (v.8.8)Fixed RHSA-2025:12499
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2025:11047
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2025:11047
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0)Fixed RHSA-2024:10777
Red Hat Satellite 6.15 for RHEL 8Fixed RHSA-2025:17614
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2025:15124
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2025:15124
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2025:13269
Satellite Client 6 for RHEL 8Fixed RHSA-2025:15371
Satellite Client 6 for RHEL 9Fixed RHSA-2025:15371
Not affected: 6 products
  • Red Hat 3scale API Management Platform 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Satellite 6.15 for RHEL 8
  • Red Hat Satellite 6.17 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-49761
  2. 2026-10-03 Alias added: GHSA-2rxp-v6pw-ch6m

References

Patch 1

Advisory 4

Other 4

  • TI-2024-27968 REXML DoS vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-27475 REXML DoS vulnerability CVSS 3.1HIGH 7.5
  • TI-2021-09890 The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1… CVSS 3.1HIGH 7.5
  • TI-2024-23250 REXML contains a denial of service vulnerability CVSS 3.1MEDIUM 5.3
  • TI-2024-29047 REXML denial of service vulnerability CVSS 3.1MEDIUM 5.9
  • TI-2024-26802 Denial of service in REXML CVSS 3.1MEDIUM 4.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences