CVE-2024-41946

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Aug 1, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-419475.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another CVE-2024-419485.0biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party b CVE-2024-419496.4biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party b CVE-2024-41952.7Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authent CVE-2024-419507.5Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. H CVE-2024-419514.4Pheonix App is a Python application designed to streamline various tasks, from managing files to playing mini-games. The issue is that the m CVE-2024-419525.3Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which CVE-2024-419536.1Zitadel is an open source identity management system. ZITADEL uses HTML for emails and renders certain information such as usernames dynamic CVE-2024-419547.8FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt CVE-2024-419555.4Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redire CVE-2024-419568.1Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repositor CVE-2024-419575.3Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding