CVE-2024-39908

RubyGems/rexml CVE-2024-39908: medium 4.3, EPSS 1.49%

REXML denial of service vulnerability

Action: Upgrade rexml to 3.3.2 or later.

bundle update rexml

Affected

Fixed versions

Sources

• osv: GHSA-4xqq-m2hx-25v8
• https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8
• https://nvd.nist.gov/vuln/detail/CVE-2024-39908
• https://github.com/ruby/rexml
• https://github.com/ruby/rexml/releases/tag/v3.3.2
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-39908.yml
• https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html
• https://security.netapp.com/advisory/ntap-20250117-0008
• https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908

CVE-2024-39908 · published 2024-07-16T19:49:15Z · modified 2026-09-10T03:50:16.309216229Z · JSON