REXML DoS Vulnerability in Ruby Packages: CVE-2024-43398
Summary
CVE-2024-43398: REXML is an XML toolkit for Ruby. Affects ruby-rexml across 2 version ranges.
< 3.3.9-r0
< 95871f399eda642a022b03550479b7994895c742
Fixed in 3.3.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
REXML is an XML toolkit for Ruby, widely used for parsing and manipulating XML documents. It provides a tree parser API, allowing developers to create and navigate XML document structures easily. However, prior to version 3.3.6, REXML was susceptible to a Denial of Service (DoS) vulnerability when parsing XML documents with deeply nested elements that share the same local name attributes. This flaw can lead to excessive resource consumption, potentially crashing applications that rely on REXML for XML processing.
Vulnerability Detail
The vulnerability identified as CVE-2024-43398 affects the REXML gem versions before 3.3.6. It arises when the library processes XML documents containing numerous deeply nested elements with identical local name attributes. This can result in a Denial of Service (DoS) condition, where the application may become unresponsive or crash due to excessive memory or CPU usage. The vulnerability is particularly concerning for applications that parse untrusted XML data using the tree parser API, such as REXML::Document.new. In contrast, other parser APIs like stream parser and SAX2 are not impacted by this issue.
How To Fix
Minimum fixed version
3.3.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade ruby-rexmlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider using alternative XML parsing methods that are not affected by this vulnerability, such as the stream parser API or SAX2 parser API. These methods do not suffer from the same DoS risk associated with deeply nested elements in XML documents.
Conclusion
The REXML DoS vulnerability (CVE-2024-43398) poses a significant risk to applications that utilize the REXML gem for XML parsing. It is crucial to update to version 3.3.6 or later to mitigate this risk. For those unable to upgrade immediately, alternative parsing methods should be employed to ensure application stability.
See every vulnerability recorded for ruby-rexml →
FAQ
CVE-2024-43398 is a vulnerability in the REXML gem for Ruby that can lead to a Denial of Service (DoS) when parsing XML documents with deeply nested elements sharing the same local name attributes.
Versions of the REXML gem prior to 3.3.6 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected without requiring signup.
The vulnerability can lead to excessive resource consumption, causing applications to crash or become unresponsive when processing maliciously crafted XML documents.
If you cannot upgrade to the patched version, consider using alternative XML parsing methods such as the stream parser API or SAX2 parser API to avoid the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for ruby-rexml.
