{"action":"Upgrade rexml to 3.3.9 or later.","affected":[{"fixed":"3.3.9","introduced":"0"}],"component":"rexml","cve_ids":["CVE-2024-49761","CVE-2025-10990"],"ecosystem":"RubyGems","epss":0.0142,"exploited":false,"fixed_versions":["3.3.9"],"ghsa_id":"GHSA-2rxp-v6pw-ch6m","id":"tcs_01M5KEG1091ZFD4CEAKSS2K39V","modified_at":"2026-09-10T03:50:19.086573705Z","published_at":"2024-10-28T14:10:18Z","references":["https://osv.dev/vulnerability/GHSA-2rxp-v6pw-ch6m","https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m","https://nvd.nist.gov/vuln/detail/CVE-2024-49761","https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f","https://github.com/ruby/rexml","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-49761.yml","https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html","https://security.netapp.com/advisory/ntap-20241227-0004","https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-2rxp-v6pw-ch6m","url":"https://osv.dev/vulnerability/GHSA-2rxp-v6pw-ch6m"}],"summary":"REXML ReDoS vulnerability"}