CVE-2024-35176 – REXML, an XML toolkit for Ruby, has a denial of... (How to Fix)

Q: How do I fix CVE-2024-35176?

1. Update REXML gem: 'gem update rexml' 2. Update Gemfile to specify 'gem "rexml", ">= 3.2.7"' 3. Run 'bundle update rexml' if using Bundler 4. Restart application services

Q: What is the severity of CVE-2024-35176?

CVE-2024-35176 has a CVSS score of 5.3 (MEDIUM). REXML, an XML toolkit for Ruby, has a denial of service vulnerability when parsing XML with many '<' characters in attribute values. Attackers can cause resource exhaustion and service disruption by sending specially crafted XML. This affects applications that parse untrusted XML input using vulnerable REXML versions.

📋 TL;DR

REXML, an XML toolkit for Ruby, has a denial of service vulnerability when parsing XML with many '<' characters in attribute values. Attackers can cause resource exhaustion and service disruption by sending specially crafted XML. This affects applications that parse untrusted XML input using vulnerable REXML versions.

💻 Affected Systems

Products:

Ruby REXML gem

Versions: All versions before 3.2.6

Operating Systems: All operating systems running Ruby with REXML

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects applications that parse XML using REXML. Applications not using REXML or not parsing XML are not vulnerable.

📦 What is this software?

Rexml by Ruby Lang

View all CVEs affecting Rexml →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service unavailability due to resource exhaustion, potentially affecting all users of the vulnerable application.

🟠

Likely Case

Degraded performance or temporary service disruption for applications processing malicious XML input.

🟢

If Mitigated

Minimal impact with proper input validation and updated REXML versions.

🌐 Internet-Facing: MEDIUM - Applications accepting XML input from external sources are vulnerable to DoS attacks.

🏢 Internal Only: LOW - Internal systems not processing untrusted XML are less likely to be affected.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted XML to vulnerable endpoints. No authentication needed if application accepts XML input.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.2.7 or later

Vendor Advisory: https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176

Restart Required: Yes

Instructions:

1. Update REXML gem: 'gem update rexml' 2. Update Gemfile to specify 'gem "rexml", ">= 3.2.7"' 3. Run 'bundle update rexml' if using Bundler 4. Restart application services

🔧 Temporary Workarounds

Avoid parsing untrusted XML

all

Implement input validation to reject or sanitize XML containing excessive '<' characters in attributes

🧯 If You Can't Patch

Implement XML input validation and sanitization to reject malicious payloads
Use rate limiting and request filtering to block excessive XML processing attempts

🔍 How to Verify

Check if Vulnerable:

Check REXML version: 'gem list rexml' or 'bundle show rexml'

Check Version:

ruby -e "require 'rexml'; puts REXML::VERSION"

Verify Fix Applied:

Confirm REXML version is 3.2.7 or higher: 'rexml --version' or check Gemfile.lock

📡 Detection & Monitoring

Log Indicators:

Increased CPU/memory usage during XML parsing
Application crashes or timeouts when processing XML

Network Indicators:

Incoming XML payloads with repeated '<' characters in attribute values

SIEM Query:

source="application.log" AND ("XML parsing" OR "REXML") AND ("timeout" OR "high memory" OR "high CPU")

📊 Metadata

CVE ID: CVE-2024-35176

CVSS v3 Score: 5.3 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE: CWE-400

Published: May 16, 2024

Last Updated: November 3, 2025

🔗 References

https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb Patch
https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh Vendor Advisory
https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176 Vendor Advisory
https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb Patch
https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh Vendor Advisory
https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html
https://security.netapp.com/advisory/ntap-20250306-0001/ Third Party Advisory
https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176 Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35176, you might also want to check these: