CVE-2024-49761: ReDoS vulnerability in REXML
Medium
Vulnerability Details
Hi,
When [REXML](https://github.com/ruby/rexml) is used to parse an XML that has many digits between `&#` and `x...;` in a hex numeric character reference `(&#x...;)` may lead to ReDos.
Advisory: https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/
## Impact
Reduced performance or Denial of Service was possible where REXML is used to parse user input.
Actions
View on HackerOneReport Stats
- Report ID: 2807139
- State: Closed
- Substate: resolved