CVE-2024-35176: Ruby-lang REXML DOS Vulnerability

CVE-2024-35176 Overview

CVE-2024-35176 is a Denial of Service (DoS) vulnerability affecting the REXML gem, an XML toolkit for Ruby. The vulnerability exists in REXML versions prior to 3.2.6 and occurs when the parser processes XML documents containing many < characters within attribute values. This improper resource consumption issue (CWE-400) can cause the application to become unresponsive when processing maliciously crafted XML input, impacting availability for applications that parse untrusted XML data.

Critical Impact

Applications parsing untrusted XML input may experience denial of service conditions when processing specially crafted XML documents with excessive < characters in attribute values.

Affected Products

• ruby-lang rexml versions prior to 3.2.6
• Ruby applications using vulnerable REXML gem versions
• Systems with unpatched REXML dependencies including Debian and NetApp products

Discovery Timeline

• 2024-05-16 - CVE-2024-35176 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-35176

Vulnerability Analysis

This vulnerability falls under the category of Resource Exhaustion (CWE-400: Uncontrolled Resource Consumption). The REXML XML parser in Ruby exhibits inefficient behavior when handling XML documents that contain attribute values with numerous < characters. The parser's algorithmic complexity increases significantly when encountering these specially crafted inputs, leading to excessive CPU consumption and potential application hangs.

The attack is network-accessible and requires no authentication or user interaction. While the vulnerability does not affect confidentiality or integrity, it can severely impact application availability by causing legitimate parsing operations to stall or fail entirely.

Root Cause

The root cause lies in the REXML gem's attribute value parsing logic, which does not efficiently handle large numbers of < characters within attribute values. When the parser encounters these characters, it performs excessive processing operations, resulting in algorithmic complexity that scales poorly with the number of occurrences. This inefficient handling of edge-case input patterns creates a resource exhaustion condition.

Attack Vector

An attacker can exploit this vulnerability by submitting a maliciously crafted XML document to any Ruby application that uses REXML to parse untrusted XML input. The attack vector is network-based, requiring only that the attacker can supply XML content to a vulnerable parsing endpoint.

The exploitation mechanism involves creating an XML document with attribute values containing many < characters. When a vulnerable REXML parser processes this document, the inefficient parsing algorithm consumes excessive CPU resources, potentially causing the application to become unresponsive to legitimate requests.

For technical implementation details regarding the vulnerability mechanism and the specific fix applied, refer to the GitHub Security Advisory and the patch commit.

Detection Methods for CVE-2024-35176

Indicators of Compromise

• Unusual CPU spikes during XML parsing operations
• Application timeouts or hangs when processing incoming XML data
• Web server or application process becoming unresponsive after receiving XML requests
• Log entries indicating slow or stalled XML parsing operations

Detection Strategies

• Monitor Ruby application resource consumption for abnormal CPU utilization patterns during XML processing
• Implement application-level logging to track XML parsing duration and flag operations exceeding normal thresholds
• Review dependency manifests (Gemfile.lock) to identify REXML versions prior to 3.2.6
• Use software composition analysis (SCA) tools to detect vulnerable REXML dependencies across your codebase

Monitoring Recommendations

• Configure alerting for sustained high CPU usage on Ruby application servers
• Implement request timeout monitoring for endpoints that process XML input
• Monitor application availability metrics and response times for XML-processing services
• Review web application firewall (WAF) logs for unusually large or malformed XML submissions

How to Mitigate CVE-2024-35176

Immediate Actions Required

• Upgrade the REXML gem to version 3.2.7 or later immediately
• Audit all Ruby applications to identify those parsing untrusted XML input
• Implement input size limits for XML documents accepted by your applications
• Consider temporarily disabling XML parsing endpoints if immediate patching is not possible

Patch Information

The vulnerability has been addressed in REXML gem version 3.2.7 and later. The patch is available in the GitHub commit 4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb. Organizations should update their Ruby gem dependencies to include the patched version. For official announcements, refer to the Ruby Language CVE Announcement and the GitHub Security Advisory.

Additional security notices have been issued by Debian LTS and NetApp.

Workarounds

• Avoid parsing untrusted XML documents until the patch can be applied
• Implement XML schema validation to reject documents with abnormally long attribute values
• Add request timeouts for XML parsing operations to limit resource exhaustion impact
• Consider using alternative XML parsing libraries for untrusted input if REXML cannot be immediately updated

# Update REXML gem to patched version
gem update rexml

# Verify installed version (should be 3.2.7 or later)
gem list rexml

# For Bundler-managed projects, update Gemfile
# Add: gem 'rexml', '>= 3.2.7'
bundle update rexml