Every CVE Search/ Get API key

CVE-2025-10990

Rexml: rexml: denial of service via inefficient regex parsing

7.5 HighFix available

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.55%Up 0.4 points since Feb 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Rexml: rexml: denial of service via inefficient regex parsing

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

Record
CVE-2025-10990
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
EUVDEUVD-2025-208140 7.5

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

Record
EUVD-2025-208140
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-qg2f-7w4r-25f2 7.5

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex)...

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

Record
GHSA-qg2f-7w4r-25f2
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
NVD 7.5

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

Record
CVE-2025-10990
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSVCVE-2024-49761 6.6

REXML ReDoS vulnerability

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

Record
CVE-2024-49761
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Weakness
CWE-1333
Updated
2026-11-02
OSV 7.5

Rexml: rexml: denial of service via inefficient regex parsing

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

Record
CVE-2025-10990
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-2rxp-v6pw-ch6m 6.6

REXML ReDoS vulnerability

Impact

The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;).

This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.

Patches

The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

Workarounds

Use Ruby 3.2 or later instead of Ruby 3.1.

References

Record
GHSA-2rxp-v6pw-ch6m
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333
Updated
2026-11-02
OSVRHSA-2025:17606 7.5

Red Hat Security Advisory: Satellite 6.17.5 Async Update

Record
RHSA-2025:17606
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:17613 7.5

Red Hat Security Advisory: Satellite 6.16.5.4 Async Update

Record
RHSA-2025:17613
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:17693 7.5

Red Hat Security Advisory: Satellite 6 Client Bug Fix Update

Record
RHSA-2025:17693
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-10990 7.5

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

Record
UBUNTU-CVE-2025-10990
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rexml
RubyGems
From an advisory covering 2 CVEs
 before 3.3.9, plus listed versions
3.1.7.33.1.83.1.93.1.9.13.2.0
Show 18 moreShow less
3.2.13.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.03.3.13.3.23.3.33.3.43.3.53.3.63.3.73.3.8
3.3.9
puppet-agent
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 3 CVEs
 before 0:8.8.1-3.el9sat
0:8.8.1-3.el9sat
puppet-agent
Red Hat:satellite:6.17::el9
From an advisory covering 3 CVEs
 before 0:8.8.1-3.el9sat
0:8.8.1-3.el9sat
cjson
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debuginfo
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debugsource
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson
Red Hat:satellite:6.17::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debuginfo
Red Hat:satellite:6.17::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debugsource
Red Hat:satellite:6.17::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
python-django
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
Show 45 moreShow less
Affected packages
PackageAffectedFixed
python3.11-django
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
python-django
Red Hat:satellite:6.17::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
python3.11-django
Red Hat:satellite:6.17::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
puppet-agent
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 3 CVEs
 before 0:8.8.1-3.el8sat
0:8.8.1-3.el8sat
puppet-agent
Red Hat:satellite:6.16::el8
From an advisory covering 3 CVEs
 before 0:8.8.1-3.el8sat
0:8.8.1-3.el8sat
puppet-agent
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 3 CVEs
 before 0:8.8.1-3.el9sat
0:8.8.1-3.el9sat
puppet-agent
Red Hat:satellite:6.16::el9
From an advisory covering 3 CVEs
 before 0:8.8.1-3.el9sat
0:8.8.1-3.el9sat
cjson
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson-debuginfo
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson-debugsource
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson
Red Hat:satellite:6.16::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson-debuginfo
Red Hat:satellite:6.16::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson-debugsource
Red Hat:satellite:6.16::el8
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el8sat
0:1.7.18-2.el8sat
cjson
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debuginfo
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debugsource
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson
Red Hat:satellite:6.16::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debuginfo
Red Hat:satellite:6.16::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
cjson-debugsource
Red Hat:satellite:6.16::el9
From an advisory covering 3 CVEs
 before 0:1.7.18-2.el9sat
0:1.7.18-2.el9sat
python-django
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el8pc
0:4.2.24-0.1.el8pc
python3.11-django
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el8pc
0:4.2.24-0.1.el8pc
python-django
Red Hat:satellite:6.16::el8
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el8pc
0:4.2.24-0.1.el8pc
python3.11-django
Red Hat:satellite:6.16::el8
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el8pc
0:4.2.24-0.1.el8pc
python-django
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
python3.11-django
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
python-django
Red Hat:satellite:6.16::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
python3.11-django
Red Hat:satellite:6.16::el9
From an advisory covering 3 CVEs
 before 0:4.2.24-0.1.el9pc
0:4.2.24-0.1.el9pc
puppet-agent
Red Hat:rhel_satellite_client:6::el8
 before 0:7.34.0-4.el8sat
0:7.34.0-4.el8sat
puppet-agent
Red Hat:rhel_satellite_client:6::el9
 before 0:7.34.0-4.el9sat
0:7.34.0-4.el9sat
jruby
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.5.6-5ubuntu11.5.6-61.5.6-71.5.6-9+deb8u2build0.14.04.1~esm2
 None known
ruby2.3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.3.0-12.3.0-22.3.0-4ubuntu22.3.0-4ubuntu32.3.0-5ubuntu1
Show 28 moreShow less
2.3.1-2~16.042.3.1-2~16.04.22.3.1-2~16.04.42.3.1-2~16.04.52.3.1-2~16.04.62.3.1-2~16.04.72.3.1-2~16.04.92.3.1-2~16.04.102.3.1-2~16.04.112.3.1-2~16.04.122.3.1-2~ubuntu16.04.132.3.1-2~ubuntu16.04.142.3.1-2~ubuntu16.04.152.3.1-2~ubuntu16.04.162.3.1-2~ubuntu16.04.16+esm12.3.1-2~ubuntu16.04.16+esm22.3.1-2~ubuntu16.04.16+esm32.3.1-2~ubuntu16.04.16+esm42.3.1-2~ubuntu16.04.16+esm52.3.1-2~ubuntu16.04.16+esm62.3.1-2~ubuntu16.04.16+esm72.3.1-2~ubuntu16.04.16+esm82.3.1-2~ubuntu16.04.16+esm92.3.1-2~ubuntu16.04.16+esm102.3.1-2~ubuntu16.04.16+esm112.3.1-2~ubuntu16.04.16+esm122.3.1-2~ubuntu16.04.16+esm142.3.1-2~ubuntu16.04.16+esm15
 None known
jruby
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.7.21-2ubuntu41.7.22-1ubuntu1
 None known
ruby2.5
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.5.0~preview1-1ubuntu22.5.0-4ubuntu12.5.0-4ubuntu42.5.0-5ubuntu12.5.0-6ubuntu1
Show 23 moreShow less
2.5.1-1ubuntu12.5.1-1ubuntu1.12.5.1-1ubuntu1.22.5.1-1ubuntu1.42.5.1-1ubuntu1.52.5.1-1ubuntu1.62.5.1-1ubuntu1.72.5.1-1ubuntu1.82.5.1-1ubuntu1.92.5.1-1ubuntu1.102.5.1-1ubuntu1.112.5.1-1ubuntu1.122.5.1-1ubuntu1.132.5.1-1ubuntu1.142.5.1-1ubuntu1.152.5.1-1ubuntu1.162.5.1-1ubuntu1.16+esm12.5.1-1ubuntu1.16+esm32.5.1-1ubuntu1.16+esm42.5.1-1ubuntu1.16+esm52.5.1-1ubuntu1.16+esm62.5.1-1ubuntu1.16+esm72.5.1-1ubuntu1.16+esm8
 None known
jruby
Ubuntu:18.04:LTS
 All versions, plus listed versions
9.1.13.0-19.1.17.0-1~18.04
 None known
ruby2.7
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.7.0-12.7.0-22.7.0-32.7.0-42.7.0-4ubuntu1
Show 23 moreShow less
2.7.0-5ubuntu12.7.0-5ubuntu1.12.7.0-5ubuntu1.22.7.0-5ubuntu1.32.7.0-5ubuntu1.42.7.0-5ubuntu1.52.7.0-5ubuntu1.62.7.0-5ubuntu1.72.7.0-5ubuntu1.82.7.0-5ubuntu1.92.7.0-5ubuntu1.102.7.0-5ubuntu1.112.7.0-5ubuntu1.122.7.0-5ubuntu1.132.7.0-5ubuntu1.142.7.0-5ubuntu1.152.7.0-5ubuntu1.162.7.0-5ubuntu1.172.7.0-5ubuntu1.182.7.0-5ubuntu1.18+esm12.7.0-5ubuntu1.18+esm32.7.0-5ubuntu1.18+esm42.7.0-5ubuntu1.18+esm5
 None known
jruby
Ubuntu:20.04:LTS
 All versions, plus listed versions
9.1.17.0-39.1.17.0-3build59.1.17.0-3build6
 None known
ruby3.0
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.0.2-5ubuntu13.0.2-73.0.2-7ubuntu23.0.2-7ubuntu2.13.0.2-7ubuntu2.2
Show 10 moreShow less
3.0.2-7ubuntu2.33.0.2-7ubuntu2.43.0.2-7ubuntu2.53.0.2-7ubuntu2.63.0.2-7ubuntu2.73.0.2-7ubuntu2.83.0.2-7ubuntu2.103.0.2-7ubuntu2.113.0.2-7ubuntu2.123.0.2-7ubuntu2.13
 None known
jruby
Ubuntu:24.04:LTS
 All versions, plus listed versions
9.3.9.0+ds-19.4.5.0+ds-19.4.5.0+ds-1ubuntu19.4.6.0+ds-1ubuntu3
 None known
ruby3.2
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.2.3-13.2.3-1build23.2.3-1build33.2.3-1ubuntu0.24.04.13.2.3-1ubuntu0.24.04.3
Show 4 moreShow less
3.2.3-1ubuntu0.24.04.53.2.3-1ubuntu0.24.04.63.2.3-1ubuntu0.24.04.73.2.3-1ubuntu0.24.04.8
 None known
jruby
Ubuntu:25.10
 All versions, plus listed versions
9.4.8.0+ds-2ubuntu19.4.8.0+ds-3ubuntu1
 None known
ruby3.3
Ubuntu:25.10
 All versions, plus listed versions
3.3.7-1ubuntu23.3.8-2ubuntu13.3.8-2ubuntu23.3.8-2ubuntu2.1
 None known
jruby
Ubuntu:26.10
 All versions, plus listed versions
9.4.8.0+ds-3ubuntu19.4.14.0+ds-1
 None known
ruby3.3
Ubuntu:26.10
 All versions, plus listed versions
3.3.8-2ubuntu33.3.8-2.2ubuntu4
 None known
jruby
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.4.8.0+ds-3ubuntu1
 None known
ruby3.3
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.3.8-2ubuntu23.3.8-2ubuntu33.3.8-2ubuntu3.1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-10990 is a high vulnerability (CVSS 7.5) in Red Hat Satellite 6.16 For Rhel 8, published October 28, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in puppet-agent 0:7.34.0-4.el8sat.

References

Show 42 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open