Ruby

CVE-2014-8080: Denial of Service XML Expansion

Posted by zzak on 27 Oct 2014

Unrestricted entity expansion can lead to a DoS vulnerability in REXML. This vulnerability has been assigned the CVE identifier CVE-2014-8080. We strongly recommend to upgrade Ruby.

Details

When reading text nodes from an XML document, the REXML parser can be coerced into allocating extremely large string objects which can consume all of the memory on a machine, causing a denial of service.

Impacted code will look something like this:

require 'rexml/document'

xml = <<XML
<!DOCTYPE root [
  # ENTITY expansion vector
]>
<cd></cd>
XML

p REXML::Document.new(xml)

All users running an affected release should either upgrade or use one of the workarounds immediately.

Affected versions

  • All Ruby 1.9 versions prior to Ruby 1.9.3 patchlevel 550
  • All Ruby 2.0 versions prior to Ruby 2.0.0 patchlevel 594
  • All Ruby 2.1 versions prior to Ruby 2.1.4
  • prior to trunk revision 48161

Workarounds

If you cannot upgrade Ruby, use this monkey patch as a workaround on versions of Ruby 2.1.0+:

class REXML::Entity
  def value
      if @value
        matches = @value.scan(PEREFERENCE_RE)
        rv = @value.clone
        if @parent
          sum = 0
          matches.each do |entity_reference|
            entity_value = @parent.entity( entity_reference[0] )
            if sum + entity_value.bytesize > Security.entity_expansion_text_limit
              raise "entity expansion has grown too large"
            else
              sum += entity_value.bytesize
            end
            rv.gsub!( /%#{entity_reference.join};/um, entity_value )
          end
        end
        return rv
      end
      nil
   end
end

For versions of Ruby older than 2.1.0, you can use the following monkey patch:

class REXML::Entity
  def value
      if @value
        matches = @value.scan(PEREFERENCE_RE)
        rv = @value.clone
        if @parent
          sum = 0
          matches.each do |entity_reference|
            entity_value = @parent.entity( entity_reference[0] )
            if sum + entity_value.bytesize > Document.entity_expansion_text_limit
              raise "entity expansion has grown too large"
            else
              sum += entity_value.bytesize
            end
            rv.gsub!( /%#{entity_reference.join};/um, entity_value )
          end
        end
        return rv
      end
      nil
   end
end

Credits

Thanks to Willis Vandevanter for reporting this issue.

History

  • Originally published at 2014-10-27 12:00:00 (UTC)

Recent News

Ruby 4.1.0-preview1 Released

We are pleased to announce the release of Ruby 4.1.0-preview1. Ruby 4.1 introduces Ractor local GC, Windows support of YJIT, autoload_relative, and adds many improvements....

Posted by naruse on 12 Oct 2026

Ruby 3.4.11 Released

Ruby 3.4.11 has been released. This is a regular scheduled update release includes bugfixes.

Posted by nagachika on 23 Sep 2026

More News...