https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T22:02:22.354123+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2024:10834 ALSA-2024:10834 — Important: ruby:3.1 security update 2026-10-03T22:02:22.927919+00:00

Affected: AlmaLinux:8: ruby, AlmaLinux:8: ruby-bundled-gems, AlmaLinux:8: ruby-default-gems, AlmaLinux:8: ruby-devel, AlmaLinux:8: ruby-doc, AlmaLinux:8: ruby-libs, AlmaLinux:8: rubygem-abrt, AlmaLinux:8: rubygem-abrt-doc, AlmaLinux:8: rubygem-bigdecimal, AlmaLinux:8: rubygem-bundler and 19 more

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* rexml: REXML ReDoS vulnerability (CVE-2024-49761)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2024-09876 bdu:2024-09876 2026-10-03T22:02:22.928035+00:00 bdu:2024-09876 https://cve.radiocsirt.org/vuln/brew-asciidoctor-cve-2024-49761 BREW-asciidoctor-CVE-2024-49761 — REXML ReDoS vulnerability 2026-10-03T22:02:22.928057+00:00

Affected: Homebrew: asciidoctor

### Impact

The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between `&#` and `x...;` in a hex numeric character reference (`&#x...;`).

This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.

### Patches

The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

### Workarounds

Use Ruby 3.2 or later instead of Ruby 3.1.

### References

* https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0279 certfr-2025-avi-0279 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T22:02:22.928089+00:00 certfr-2025-avi-0279 https://cve.radiocsirt.org/vuln/euvd-2026-258188 EUVD-2026-258188 2026-10-03T22:02:22.928106+00:00 EUVD-2026-258188 https://cve.radiocsirt.org/vuln/fkie_cve-2024-49761 fkie_cve-2024-49761 2026-10-03T22:02:22.928118+00:00

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-2rxp-v6pw-ch6m GHSA-2rxp-v6pw-ch6m — REXML ReDoS vulnerability 2026-10-03T22:02:22.928143+00:00

Affected: RubyGems: rexml

### Impact

The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between `&#` and `x...;` in a hex numeric character reference (`&#x...;`).

This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.

### Patches

The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

### Workarounds

Use Ruby 3.2 or later instead of Ruby 3.1.

### References

* https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org

 https://cve.radiocsirt.org/vuln/msrc_cve-2024-49761 msrc_CVE-2024-49761 — REXML ReDoS vulnerability 2026-10-03T22:02:22.928173+00:00 msrc_CVE-2024-49761 https://cve.radiocsirt.org/vuln/oesa-2024-2341 OESA-2024-2341 — ruby security update 2026-10-03T22:02:22.928190+00:00

Affected: openEuler:20.03-LTS-SP4: ruby, openEuler:22.03-LTS-SP1: ruby, openEuler:24.03-LTS: ruby, openEuler:22.03-LTS-SP4: ruby, openEuler:22.03-LTS-SP3: ruby

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl). Security Fix(es): (CVE-2024-49761)

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:0129-1 openSUSE-SU-2025:0129-1 — Security update for rubygem-rexml 2026-10-03T22:02:22.928218+00:00

Security update for rubygem-rexml

 https://cve.radiocsirt.org/vuln/rhsa-2024:10777 RHSA-2024:10777 — Red Hat Security Advisory: pcs security update 2026-10-03T22:02:22.928239+00:00

rexml: REXML ReDoS vulnerability

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-49761 UBUNTU-CVE-2024-49761 2026-10-03T22:02:22.928255+00:00

Affected: Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:Pro:18.04:LTS: ruby2.5, Ubuntu:20.04:LTS: ruby2.7, Ubuntu:22.04:LTS: ruby3.0, Ubuntu:24.04:LTS: ruby3.2

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3276 WID-SEC-W-2024-3276 — Ruby: Schwachstelle ermöglicht Denial of Service 2026-10-03T22:02:22.928282+00:00

Ein Angreifer kann eine Schwachstelle in Ruby ausnutzen, um einen Denial of Service Angriff durchzuführen.