-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from inefficient processing of specific character patterns in XML parsing. While exact function names aren't explicitly disclosed in the advisory, the SAX2 parser (mentioned in release notes) and document parsing entry points are primary candidates given their role in XML processing. The medium confidence reflects the lack of direct commit/diff evidence, but aligns with: 1) The CWE-400 resource consumption pattern 2) SAX2 parser fixes mentioned in v3.3.2 release notes 3) Historical precedent in similar REXML vulnerabilities involving parsing loops.
RubyRuby| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rexml | rubygems | < 3.3.2 | 3.3.2 |
Ongoing coverage of React2Shell