CVE-2025-10990

HighCVSS 7.5

Published: 27/02/2026(UTC)Updated: 26/06/2026(UTC)Translated: 27/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

37th percentile - higher than 37% of all known CVEs

Summary

A flaw was found in REXML where inefficient regex parsing occurs when processing hex numeric character references (&#x...;) in XML documents. A remote attacker could exploit this to cause a Regular Expression Denial of Service (ReDoS), impacting component availability. This issue results from an incomplete fix for CVE-2024-49761.

Risk Assessment

The organization risks service disruption in applications using REXML, potentially leading to unavailability of XML processing components.

Recommendation

Immediately update the REXML library to a version containing the complete fix for both CVE-2024-49761 and CVE-2025-10990.

Other vulnerabilities in REXML

CVE-2025-58767Low
REXML is an XML toolkit for Ruby. Versions 3.3.3 to 3.4.1 have a DoS vulnerability when parsing XML containing multiple XML declarations. If you parse untrusted XMLs, you may be impacted. REXML gem 3.4.2 or later includes the patches.

Original NVD description (English source)

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.