-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RubyRubyMiggo AIRoot Cause AnalysisThe vulnerability stems from inefficient parsing of quoted attribute values. The pre-patch code in baseparser.rb used a regex that required scanning the entire attribute value at once (.*? pattern), which becomes exponentially slower with many consecutive special characters. The commit replaced this with chunked reading via read_until, demonstrating the vulnerable pattern was in the regex-based attribute value extraction. The Source class modifications adding read_until and modifying read() show the original I/O handling contributed to the resource exhaustion issue. The added performance test validates the quadratic complexity problem in attribute parsing.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rexml | rubygems | < 3.2.7 | 3.2.7 |
Ongoing coverage of React2Shell