CVE-2024-43398 - CVE House
Back to Database
Status published Medium CVE-2024-43398

REXML denial of service vulnerability

Vulnerability Description

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-43398

Credits & Attribution

No credits recorded in the NVD database.

References

More from ruby

View All →
CVE-2025-61594
URI Credential Leakage Bypass over CVE-2025-27221
Low 2.1
CVE-2025-58767
REXML has a DoS condition when parsing malformed XML file
Low 1.2
CVE-2025-43857
net-imap rubygem vulnerable to possible DoS by memory exhaustion
Medium 6
CVE-2025-27788
Ruby JSON Parser has Out-of-bounds Read
High 7.5
CVE-2025-25186
Net::IMAP vulnerable to possible DoS by memory exhaustion
Medium 6.5

Affected Vendor

Affected Software

rexml
Vulnerable Versions:
< 3.3.6

Timeline

Official Publish: August 22nd, 2024
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-776

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.