Uncontrolled Resource Consumption Affecting rexml package, versions <3.2.7
Threat Intelligence
EPSS
0.05% (17th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-REXML-6861566
- published 17 May 2024
- disclosed 16 May 2024
- credit mprogrammer
Introduced: 16 May 2024
CVE-2024-35176 Open this link in a new tabHow to fix?
Upgrade rexml to version 3.2.7 or higher.
Overview
rexml is an An XML toolkit for Ruby.
Affected versions of this package are vulnerable to Uncontrolled Resource Consumption when parsing an XML that has many <s in an attribute value. An attacker can cause a denial of service by exploiting this behavior.
Workaround
This vulnerability can be mitigated by not parsing untrusted XMLs.
References
CVSS Scores
version 3.1