https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 09:24:02 +0000 https://cve.radiocsirt.org/vuln/brew-asciidoctor-cve-2024-49761 <p><strong>Affected:</strong> Homebrew: asciidoctor</p> <p>### Impact</p> <p>The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between `&amp;#` and `x...;` in a hex numeric character reference (`&amp;#x...;`).</p> <p>This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.</p> <p>### Patches</p> <p>The REXML gem 3.3.9 or later include the patch to fix the vulnerability.</p> <p>### Workarounds</p> <p>Use Ruby 3.2 or later instead of Ruby 3.1.</p> <p>### References</p> <p>* https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org</p> <p><strong>Affected:</strong> Homebrew: asciidoctor</p> <p>### Impact</p> <p>The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between `&amp;#` and `x...;` in a hex numeric character reference (`&amp;#x...;`).</p> <p>This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.</p> <p>### Patches</p> <p>The REXML gem 3.3.9 or later include the patch to fix the vulnerability.</p> <p>### Workarounds</p> <p>Use Ruby 3.2 or later instead of Ruby 3.1.</p> <p>### References</p> <p>* https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org</p> https://cve.radiocsirt.org/vuln/brew-asciidoctor-cve-2024-49761 https://cve.radiocsirt.org/vuln/euvd-2026-330426 EUVD-2026-330426 https://cve.radiocsirt.org/vuln/euvd-2026-330426 https://cve.radiocsirt.org/vuln/fkie_cve-2025-10990 <p>A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&amp;#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.</p> <p>A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&amp;#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-10990 https://cve.radiocsirt.org/vuln/ghsa-qg2f-7w4r-25f2 <p>A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&amp;#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.</p> <p>A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&amp;#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.</p> https://cve.radiocsirt.org/vuln/ghsa-qg2f-7w4r-25f2 https://cve.radiocsirt.org/vuln/rhsa-2025:17606 <p>rexml: REXML: Denial of Service via inefficient regex parsing cJSON: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings django: Django SQL injection in FilteredRelation column aliases</p> <p>rexml: REXML: Denial of Service via inefficient regex parsing cJSON: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON pointer strings django: Django SQL injection in FilteredRelation column aliases</p> https://cve.radiocsirt.org/vuln/rhsa-2025:17606 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-10990 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jruby, Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:16.04:LTS: jruby, Ubuntu:Pro:18.04:LTS: ruby2.5, Ubuntu:18.04:LTS: jruby, Ubuntu:Pro:20.04:LTS: ruby2.7, Ubuntu:20.04:LTS: jruby, Ubuntu:22.04:LTS: ruby3.0, Ubuntu:24.04:LTS: jruby, Ubuntu:24.04:LTS: ruby3.2 and 4 more</p> <p>A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&amp;#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jruby, Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:16.04:LTS: jruby, Ubuntu:Pro:18.04:LTS: ruby2.5, Ubuntu:18.04:LTS: jruby, Ubuntu:Pro:20.04:LTS: ruby2.7, Ubuntu:20.04:LTS: jruby, Ubuntu:22.04:LTS: ruby3.0, Ubuntu:24.04:LTS: jruby, Ubuntu:24.04:LTS: ruby3.2 and 4 more</p> <p>A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&amp;#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-10990 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2244 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Satellite und Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen und um beliebige SQL-Befehle einzuschleusen.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Satellite und Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen und um beliebige SQL-Befehle einzuschleusen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2244