https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T07:28:02.017732+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-asciidoctor-cve-2024-49761 BREW-asciidoctor-CVE-2024-49761 — REXML ReDoS vulnerability 2026-10-09T07:28:02.045419+00:00

Affected: Homebrew: asciidoctor

### Impact

The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between `&#` and `x...;` in a hex numeric character reference (`&#x...;`).

This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.

### Patches

The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

### Workarounds

Use Ruby 3.2 or later instead of Ruby 3.1.

### References

* https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org

 https://cve.radiocsirt.org/vuln/euvd-2026-330426 EUVD-2026-330426 2026-10-09T07:28:02.045487+00:00 EUVD-2026-330426 https://cve.radiocsirt.org/vuln/fkie_cve-2025-10990 fkie_cve-2025-10990 2026-10-09T07:28:02.045504+00:00

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

 https://cve.radiocsirt.org/vuln/ghsa-qg2f-7w4r-25f2 GHSA-qg2f-7w4r-25f2 2026-10-09T07:28:02.045529+00:00

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

 https://cve.radiocsirt.org/vuln/rhsa-2025:17606 RHSA-2025:17606 — Red Hat Security Advisory: Satellite 6.17.5 Async Update 2026-10-09T07:28:02.045546+00:00

rexml: REXML: Denial of Service via inefficient regex parsing cJSON: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings django: Django SQL injection in FilteredRelation column aliases

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-10990 UBUNTU-CVE-2025-10990 2026-10-09T07:28:02.045567+00:00

Affected: Ubuntu:Pro:14.04:LTS: jruby, Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:16.04:LTS: jruby, Ubuntu:Pro:18.04:LTS: ruby2.5, Ubuntu:18.04:LTS: jruby, Ubuntu:Pro:20.04:LTS: ruby2.7, Ubuntu:20.04:LTS: jruby, Ubuntu:22.04:LTS: ruby3.0, Ubuntu:24.04:LTS: jruby, Ubuntu:24.04:LTS: ruby3.2 and 4 more

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2244 WID-SEC-W-2025-2244 — Red Hat Satellite (cJSON, django, rexml): Mehrere Schwachstellen 2026-10-09T07:28:02.045605+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Satellite und Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen und um beliebige SQL-Befehle einzuschleusen.