CVE-2024-39908

Deeper analysis

REXML, the XML parsing toolkit bundled with Ruby, contains multiple denial-of-service flaws in all gem versions before 3.3.1. The defects are triggered when the parser processes documents containing large numbers of specific characters such as “<”, “0”, and “%>”, causing uncontrolled resource consumption (CWE-400) that can exhaust CPU or memory. The issue received a CVSS 4.3 rating reflecting network attack vectors that require user interaction to initiate parsing.

An attacker who can supply or influence an XML document processed by a vulnerable application can trigger the resource-exhaustion condition, resulting in application slowdown or crash. Because the attack requires the target to parse attacker-controlled input, it is most relevant to services that accept untrusted XML from remote users without prior validation or size limits.

The published advisories from the Ruby core team and the REXML GitHub repository state that the vulnerabilities are resolved in REXML 3.3.2 and later; users who cannot upgrade are advised to stop parsing untrusted XML entirely. Downstream distributors such as Debian have issued corresponding updates, and vendors including NetApp have published impact statements referencing the same remediation guidance. The associated EPSS score remains low (peak 0.0833) with no material post-disclosure increase.