Rexml: rexml: denial of service via inefficient regex parsing

7.5 CVSS

Vulnerability Description

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-10990

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Unknown

View All →

CVE-2025-9978

Jeg Elementor Kit < 2.7.0 - Author+ Stored XSS

Unknown 0

CVE-2025-9959

Sandbox escape in smolagents Local Python execution environment via dunder attributes

High 7.6

CVE-2025-9900

Libtiff: libtiff write-what-where

High 8.8

CVE-2025-9784

Undertow: undertow madeyoureset http/2 ddos vulnerability

High 7.5

CVE-2025-9710

Responsive Lightbox & Gallery < 2.5.3 - Unauthenticated Stored-XSS via Comments

Unknown 0

Affected Vendor

Unknown

View all reports →

Affected Software

Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9, Satellite Client 6 for RHEL 8, Satellite Client 6 for RHEL 9

Vulnerable Versions:

6.17.5, 6.16.5.4, 0:8.8.1-3.el8sat, 0:8.8.1-3.el9sat, 0:7.34.0-4.el8sat, 0:7.34.0-4.el9sat