{"id":"CVE-2024-41946","summary":"REXML DoS vulnerability","details":"REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.","aliases":["GHSA-5866-49gr-22v4"],"modified":"2026-10-28T02:30:39.097739196Z","published":"2024-08-01T14:22:14.014Z","related":["ALSA-2024:6670","ALSA-2024:6784","ALSA-2024:6785","ALSA-2025:4063","ALSA-2025:4488","SUSE-SU-2024:3874-1","openSUSE-SU-2025:0129-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-400"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41946.json"},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html"},{"type":"WEB","url":"https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml"},{"type":"WEB","url":"https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41946.json"},{"type":"ADVISORY","url":"https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41946"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20250117-0007/"},{"type":"FIX","url":"https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ruby/rexml","events":[{"introduced":"0"},{"fixed":"e4a067e11235a2ec7a00616d41350485e384ec05"},{"fixed":"033d1909a8f259d5a7c53681bcaf14f13bcf0368"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"3.3.3"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*"},{"range":[{"fixed":"033d1909a8f259d5a7c53681bcaf14f13bcf0368"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v3.3.2","v3.3.1","v3.3.0","v3.2.9","v3.2.8","v3.2.7","v3.2.6","v3.1.9","v3.2.5","v3.2.4","v3.2.3","v3.2.2","v3.2.1","v3.2.0","v3.1.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-41946.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}