CVE-2024-49761: ReDoS vulnerability in REXML

Disclosed: 2024-11-30 13:27:33 By manun To ibb
Medium
Vulnerability Details
Hi, When [REXML](https://github.com/ruby/rexml) is used to parse an XML that has many digits between `&#` and `x...;` in a hex numeric character reference `(&#x...;)` may lead to ReDos. Advisory: https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/ ## Impact Reduced performance or Denial of Service was possible where REXML is used to parse user input.
Actions
View on HackerOne
Report Stats
  • Report ID: 2807139
  • State: Closed
  • Substate: resolved
Share this report