CVE-2025-10990— Rexml: rexml: denial of service via inefficient regex parsing
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-10990
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rexml: rexml: denial of service via inefficient regex parsing
Source: NVD (National Vulnerability Database)
Vulnerability Description
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-1333
Source: NVD (National Vulnerability Database)
Vulnerability Title
Red Hat Satellite 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat Satellite是美国红帽（Red Hat）公司的一套系统管理平台。该平台可用于扩展Linux基础架构，并提供系统管理功能，如管理、配置和监控。 Red Hat Satellite 6.16 for RHEL 8存在安全漏洞，该漏洞源于处理XML文档中的十六进制数字字符引用时存在低效的正则表达式解析，可能导致正则表达式拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | 0:8.8.1-3.el8sat ~ * | cpe:/a:redhat:satellite:6.16::el8 | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 8 | 0:8.8.1-3.el8sat ~ * | cpe:/a:redhat:satellite:6.16::el8 | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | 0:8.8.1-3.el9sat ~ * | cpe:/a:redhat:satellite:6.16::el8 | |
| Red Hat | Red Hat Satellite 6.16 for RHEL 9 | 0:8.8.1-3.el9sat ~ * | cpe:/a:redhat:satellite:6.16::el8 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:8.8.1-3.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | 0:8.8.1-3.el9sat ~ * | cpe:/a:redhat:satellite:6.17::el9 | |
| Red Hat | Satellite Client 6 for RHEL 8 | 0:7.34.0-4.el8sat ~ * | cpe:/a:redhat:rhel_satellite_client:6::el9 | |
| Red Hat | Satellite Client 6 for RHEL 9 | 0:7.34.0-4.el9sat ~ * | cpe:/a:redhat:rhel_satellite_client:6::el9 |
II. Public POCs for CVE-2025-10990
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-10990
请登录查看更多情报信息。
- 2398216 – (CVE-2025-10990) CVE-2025-10990 rexml: REXML: Denial of Service via inefficient regex parsingissue-trackingx_refsource_REDHAT
- https://nvd.nist.gov/vuln/detail/CVE-2025-10990
IV. Related Vulnerabilities
Same weakness: CWE-1333
- CVE-2026-33079
Mistune ReDoS in LINK_TITLE_RE allows denial of service with - CVE-2026-41040
GROWI 安全漏洞 - CVE-2026-40319
Giskard has a Regular Expression Denial of Service (ReDoS) i - CVE-2026-5986
Zod jsVideoUrlParser util.js getTime redos - CVE-2026-35041
ReDoS in fast-jwt when using RegExp in allowed* leading to C
V. Comments for CVE-2025-10990
No comments yet