Vulnerability · Published Feb 27, 2026 · Assigned by redhat
CVE-2025-10990Rexml: rexml: denial of service via inefficient regex parsing
High 7.5
In plain English
A high-severity regular-expression denial of service in Red Hat Satellite. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | rexml | 3.3.9 | GHSA-2rxp-v6pw-ch6m |
| Ubuntu:24.04:LTS | jruby | no fix listed | UBUNTU-CVE-2025-10990 |
| Ubuntu:25.10 | jruby | no fix listed | UBUNTU-CVE-2025-10990 |
| Ubuntu:26.04:LTS | jruby | no fix listed | UBUNTU-CVE-2025-10990 |
| Ubuntu:26.10 | jruby | no fix listed | UBUNTU-CVE-2025-10990 |
| Ubuntu:22.04:LTS | ruby3.0 | no fix listed | UBUNTU-CVE-2025-10990 |
| Ubuntu:24.04:LTS | ruby3.2 | no fix listed | UBUNTU-CVE-2025-10990 |
| Ubuntu:25.10 | ruby3.3 | no fix listed | UBUNTU-CVE-2025-10990 |
| Ubuntu:26.04:LTS | ruby3.3 | no fix listed | UBUNTU-CVE-2025-10990 |
| Ubuntu:26.10 | ruby3.3 | no fix listed | UBUNTU-CVE-2025-10990 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat Satellite | see references | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | see references |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | see references |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | see references |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | see references |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | see references |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | see references |
| Red Hat | Satellite Client 6 for RHEL 8 | see references |
| Red Hat | Satellite Client 6 for RHEL 9 | see references |
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2025:17606 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:17613 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:17693 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-10990 vdb-entry, x_refsource_REDHAT
- RHBZ#2398216 issue-tracking, x_refsource_REDHAT
- https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
- https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m
- https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/