CVE-2024-43398

RubyGems/rexml CVE-2024-43398: medium 5.9, EPSS 1.21%

REXML denial of service vulnerability

Action: Upgrade rexml to 3.3.6 or later.

bundle update rexml

Affected

Fixed versions

Sources

• osv: GHSA-vmwr-mc7x-5vc3
• https://github.com/ruby/rexml/security/advisories/GHSA-vmwr-mc7x-5vc3
• https://nvd.nist.gov/vuln/detail/CVE-2024-43398
• https://github.com/ruby/rexml/commit/7cb5eaeb221c322b9912f724183294d8ce96bae3
• https://github.com/ruby/rexml
• https://github.com/ruby/rexml/releases/tag/v3.3.6
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-43398.yml
• https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html
• https://security.netapp.com/advisory/ntap-20250103-0006
• https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398

CVE-2024-43398 · published 2024-08-22T16:40:46Z · modified 2026-09-10T03:50:55.410683386Z · JSON