VDB
DEBIAN-CVE-2024-35176
DEBIAN-CVE-2024-35176
PUBLISHED
CVSS 5.300000190734863 MEDIUM
REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | ruby3.1 | 0, 3.1.2-7, 3.1.2-7+hurd.1 |
| Debian:11 | ruby2.7 | 2.7.4-1, 2.7.4-1+deb11u2, 0 |
Exploit Intelligence
- CVE-2024-35176 poc full (github-poc)
- .bundler-audit.yml (github-poc)
Timeline
- May 16, 2024 CVE Published
- Apr 28, 2026 CVE Updated