https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T14:17:24.933163+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/brew-asciidoctor-cve-2024-49761 BREW-asciidoctor-CVE-2024-49761 — REXML ReDoS vulnerability 2026-10-06T14:17:25.819190+00:00

Affected: Homebrew: asciidoctor

### Impact

The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between `&#` and `x...;` in a hex numeric character reference (`&#x...;`).

This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.

### Patches

The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

### Workarounds

Use Ruby 3.2 or later instead of Ruby 3.1.

### References

* https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org

 https://vulnerability.circl.lu/vuln/cve-2024-49761 CVE-2024-49761 — REXML ReDoS vulnerability 2026-10-06T14:17:25.819316+00:00

Affected: ruby rexml

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.