CVE-2025-10990

EUVD-2025-208140
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 38.48%
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby2.3
jammy
dne
noble
dne
questing
dne
resolute
dne
xenial
deferred
ruby2.5
bionic
deferred
jammy
dne
noble
dne
questing
dne
resolute
dne
ruby2.7
focal
deferred
jammy
dne
noble
dne
questing
dne
resolute
dne
ruby3.0
jammy
deferred
noble
dne
questing
dne
resolute
dne
ruby3.2
jammy
dne
noble
deferred
questing
dne
resolute
dne
ruby3.3
jammy
dne
noble
dne
questing
ignored
resolute
deferred
jruby
bionic
deferred
focal
deferred
jammy
dne
noble
deferred
questing
ignored
resolute
deferred
trusty
deferred
xenial
deferred
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2025:17606
https://access.redhat.com/errata/RHSA-2025:17613
https://access.redhat.com/errata/RHSA-2025:17693
https://access.redhat.com/security/cve/CVE-2025-10990
https://bugzilla.redhat.com/show_bug.cgi?id=2398216
https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/