CVE-2025-10990
Published: 27 February 2026
Summary
CVE-2025-10990 is a high-severity Inefficient Regular Expression Complexity (CWE-1333) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 37.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-10990 is a vulnerability in the REXML XML parsing library, stemming from inefficient regular expression parsing when processing hexadecimal numeric character references (such as &#x...;) in XML documents. This flaw enables a Regular Expression Denial of Service (ReDoS) condition, which can significantly impact the availability of affected components by causing excessive resource consumption. Rated at CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and mapped to CWE-1333, it represents an incomplete fix for the prior CVE-2024-49761.
A remote, unauthenticated attacker can exploit this vulnerability by supplying specially crafted XML input containing malicious hexadecimal character references to any application or service that processes XML via REXML. Successful exploitation leads to a denial-of-service condition through CPU exhaustion, without requiring user interaction or privileges, potentially disrupting service availability for the targeted component.
Red Hat advisories detail mitigations through updated packages in RHSA-2025:17606, RHSA-2025:17613, and RHSA-2025:17693. Additional technical details and affected products are available on the Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2025-10990 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2398216.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208140
Vulnerability details
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability…
more
of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
ReDoS in XML parser directly enables application exploitation leading to endpoint DoS via crafted input causing CPU exhaustion.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely remediation of the REXML ReDoS flaw through patching, as evidenced by Red Hat advisories providing updated packages.
Implements denial-of-service protections to counter CPU exhaustion from inefficient regex parsing of malicious hex character references in XML.
Requires validation of XML inputs to reject or sanitize specially crafted hexadecimal numeric character references that trigger the ReDoS condition.