CVE-2024-39908 - CVE House
Back to Database
Status published Medium CVE-2024-39908

Denial of service in REXML

Vulnerability Description

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-39908

Credits & Attribution

No credits recorded in the NVD database.

References

More from ruby

View All →
CVE-2025-61594
URI Credential Leakage Bypass over CVE-2025-27221
Low 2.1
CVE-2025-58767
REXML has a DoS condition when parsing malformed XML file
Low 1.2
CVE-2025-43857
net-imap rubygem vulnerable to possible DoS by memory exhaustion
Medium 6
CVE-2025-27788
Ruby JSON Parser has Out-of-bounds Read
High 7.5
CVE-2025-25186
Net::IMAP vulnerable to possible DoS by memory exhaustion
Medium 6.5

Affected Vendor

Affected Software

rexml
Vulnerable Versions:
< 3.3.2

Timeline

Official Publish: July 16th, 2024
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact