There is a ReDoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier [CVE-2024-49761](https://www.cve.org/CVERecord?id=CVE-2024-49761). We strongly recommend upgrading the REXML gem.

This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.

## Details

When parsing an XML that has many digits between `&#` and `x...;` in a hex numeric character reference (`&#x...;`).

Please update REXML gem to version 3.3.9 or later.

## Affected versions

* REXML gem 3.3.8 or prior with Ruby 3.1 or prior

## Credits

Thanks to [manun](https://hackerone.com/manun) for discovering this issue.

## History

* Originally published at 2024-10-28 03:00:00 (UTC)