CVE-2024-39908
🔶 mediumSummary
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.
CVSS Score
4.3
Medium
EPSS Score
5.6
Exploit Probability
Published Date
2024-07-16
First Seen: 2026-01-05
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 5.4% of all 329,456 vulnerabilities in our database.
#311,645
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 16, 2024
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by
CISA
Last Modified
2025-11-03
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE IDs (Weakness Types)