CVE-2024-43398
🔶 mediumSummary
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability.
CVSS Score
5.9
Medium
EPSS Score
1.2
Exploit Probability
Published Date
2024-08-22
First Seen: 2026-01-05
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 33.3% of all 329,456 vulnerabilities in our database.
#219,613
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 22, 2024
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by
CISA
Last Modified
2025-11-03
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE IDs (Weakness Types)