Description
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Red Hat Satellite | — | 6.17.5 |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | — | — |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | — |
| Red Hat | Satellite Client 6 for RHEL 8 | — | — |
| Red Hat | Satellite Client 6 for RHEL 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jruby +1 | No fix yet | — |
| Ubuntu 26.04 LTS | jruby +1 | No fix yet | — |
| Ubuntu 25.10 | jruby +1 | No fix yet | — |
| Ubuntu 24.04 LTS | jruby +1 | No fix yet | — |
| Ubuntu 22.04 LTS | ruby3.0 | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jruby | No fix yet | — |
| Ubuntu 18.04 LTS | jruby | No fix yet | — |
| Ubuntu 16.04 LTS | jruby | No fix yet | — |
| Ubuntu Pro 20.04 LTS | ruby2.7 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ruby2.5 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ruby2.3 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | jruby | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | cjson | 1.7.18-2.el8sat | RHSA-2025:17613, RHSA-2025:17606 |
| Red Hat Satellite Capsule 6 | puppet-agent | 8.8.1-3.el8sat | RHSA-2025:17613, RHSA-2025:17606 |
| Red Hat Satellite Capsule 6 | python-django +1 | 4.2.24-0.1.el8pc | RHSA-2025:17613, RHSA-2025:17606 |
| Red Hat Satellite 6 | cjson | 1.7.18-2.el8sat | RHSA-2025:17613, RHSA-2025:17606 |
| Red Hat Satellite 6 | puppet-agent | 8.8.1-3.el8sat | RHSA-2025:17613, RHSA-2025:17606 |
| Red Hat Satellite 6 | python-django +1 | 4.2.24-0.1.el8pc | RHSA-2025:17613, RHSA-2025:17606 |
| Red Hat Rhel Satellite Client 6 | puppet-agent | 7.34.0-4.el8sat | RHSA-2025:17693 |
Advisories 4
- RHSA-2025:17606 Red Hat Security Advisory: Satellite 6.17.5 Async Update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2025:17613 Red Hat Security Advisory: Satellite 6.16.5.4 Async Update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2025:17693 Red Hat Security Advisory: Satellite 6 Client Bug Fix Update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- WID-SEC-2025-2244 Red Hat Satellite (cJSON, django, rexml): Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
References
- RHSA-2025:17606 vendor-advisory
- RHSA-2025:17613 vendor-advisory
- RHSA-2025:17693 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-10990 vdb-entry
- RHBZ#2398216 issue-tracking
- https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
- https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
- https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/