CVE-2024-41946

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-41946

Severity

5.3

Medium

CVSS V3

Summary

REXML DoS vulnerability

Description

REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.

References

https://images.chainguard.dev/security/CGA-gx4q-mcj6-h45f
https://github.com/advisories/GHSA-5866-49gr-22v4
https://images.chainguard.dev/security/CGA-q775-8xqc-8pj3
https://images.chainguard.dev/security/CGA-48rc-hqhv-4j62
https://images.chainguard.dev/security/CGA-wv9r-479x-qr7x
https://images.chainguard.dev/security/CGA-853j-9j8q-8fg7
https://images.chainguard.dev/security/CGA-rc59-6q33-v2xh
https://images.chainguard.dev/security/CGA-xjvv-9mgp-g829
https://images.chainguard.dev/security/CGA-624g-h8r6-hfpf
https://images.chainguard.dev/security/CGA-vhph-x8hv-4xjg
https://images.chainguard.dev/security/CGA-3xx9-8fpv-493q
https://images.chainguard.dev/security/CGA-rpwq-x8f5-5mwm
https://images.chainguard.dev/security/CGA-hm33-4h4f-h6fj
https://images.chainguard.dev/security/CGA-92q4-5gh7-j3xf
https://images.chainguard.dev/security/CGA-fhqv-j9mx-3hfc
https://images.chainguard.dev/security/CGA-vh8v-w8jp-44vq
https://images.chainguard.dev/security/CGA-3xr5-pwx9-qch9
https://images.chainguard.dev/security/CGA-crvw-4882-w64x
https://images.chainguard.dev/security/CGA-4vhw-5869-hc7w
https://images.chainguard.dev/security/CGA-w364-9xg9-2vmf
https://images.chainguard.dev/security/CGA-q9f2-m4xr-h5pc
https://images.chainguard.dev/security/CGA-v98j-mcmh-g897
https://images.chainguard.dev/security/CGA-96h6-x8g9-47fv
https://images.chainguard.dev/security/CGA-w732-86pv-mf62
https://images.chainguard.dev/security/CGA-8722-4v4g-8vjr
https://images.chainguard.dev/security/CGA-9v7f-2qj3-xv9f
https://images.chainguard.dev/security/CGA-m9mr-7fp9-mvh3
https://images.chainguard.dev/security/CGA-58gc-r4xx-4mmw
https://images.chainguard.dev/security/CGA-f7f8-m26x-gx78
https://images.chainguard.dev/security/CGA-fgqg-jcq9-jv3q
https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368
https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4
https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html
https://security.netapp.com/advisory/ntap-20250117-0007/
https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml
https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

The trusted source for open source

Talk to an expert

Privacy

Terms

CVE-2024-41946

Severity

Summary

Description

References

Affected packages

The trusted source for open source

Product

Solutions

Customers

Resources

Company