The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0118 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-49761:
    REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an     XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does     not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or     later include the patch to fix the vulnerability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ruby / rubygem-rexml installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-49761 advisory.

  - REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an     XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does     not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or     later include the patch to fix the vulnerability. (CVE-2024-49761)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-10858 advisory.

    - Fix REXML ReDoS vulnerability. (CVE-2024-49761)       Resolves: rbhz#2322153

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:10834 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rexml: REXML ReDoS vulnerability (CVE-2024-49761)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:10984 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rexml: REXML ReDoS vulnerability (CVE-2024-49761)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0736-1 advisory.

    - CVE-2024-47220: Fixed a HTTP request smuggling attack in WEBrick (bsc#1230930)
    - CVE-2024-49761: Fixed a ReDoS vulnerability in ruby rexml (bsc#1232440)

    Other fixes:

    - [ruby/uri] Fix quadratic backtracking on invalid relative URI
    - [ruby/time] Make RFC2822 regexp linear
    - [ruby/time] Fix quadratic backtracking on invalid time
    - merge some parts of CGI 0.1.1

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:13307 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rexml: REXML ReDoS vulnerability (CVE-2024-49761)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:10777 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rexml: REXML ReDoS vulnerability (CVE-2024-49761)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:10964 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * rexml: REXML ReDoS vulnerability (CVE-2024-49761)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:10858 advisory.

    * rexml: REXML ReDoS vulnerability (CVE-2024-49761)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7442-1 advisory.

    It was discovered that the Ruby CGI gem incorrectly handled parsing certain cookies. A remote attacker     could possibly use this issue to consume resources, leading to a denial of service. (CVE-2025-27219)

    It was discovered that the Ruby CGI gem incorrectly handled parsing certain regular expressions. A remote     attacker could possibly use this issue to consume resources, leading to a denial of service.
    (CVE-2025-27220)

    It was discovered that the Ruby URI gem incorrectly handled certain URI handling methods. A remote     attacker could possibly use this issue to leak authentication credentials. (CVE-2025-27221)

    It was discovered that the Ruby REXML gem incorrectly handled parsing XML documents containing many digits     in a hex numeric character reference. A remote attacker could use this issue to consume resources, leading     to a denial of service. (CVE-2024-49761)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7091-2 advisory.

    USN-7091-1 fixed several vulnerabilities in Ruby. This update provides the corresponding update for     ruby2.7 in Ubuntu 20.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
242484	Alibaba Cloud Linux 3 : 0118: pcs (ALINUX3-SA-2025:0118)	Nessus	Alibaba Cloud Linux Local Security Checks	7/22/2025	7/22/2025	high
295317	Azure Linux 3.0 Security Update: ruby / rubygem-rexml (CVE-2024-49761)	Nessus	Azure Linux Local Security Checks	1/22/2026	1/22/2026	high
212454	Oracle Linux 9 : ruby (ELSA-2024-10858)	Nessus	Oracle Linux Local Security Checks	12/11/2024	1/21/2026	high
212080	RHEL 8 : ruby:3.1 (RHSA-2024:10834)	Nessus	Red Hat Local Security Checks	12/5/2024	4/29/2025	high
212674	RHEL 9 : ruby:3.1 (RHSA-2024:10984)	Nessus	Red Hat Local Security Checks	12/12/2024	12/12/2024	high
216927	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ruby2.5 (SUSE-SU-2025:0736-1)	Nessus	SuSE Local Security Checks	2/28/2025	2/28/2025	high
244842	RHEL 8 : pcs (RHSA-2025:13307)	Nessus	Red Hat Local Security Checks	8/7/2025	8/7/2025	high
212044	RHEL 9 : pcs (RHSA-2024:10777)	Nessus	Red Hat Local Security Checks	12/4/2024	12/4/2024	high
212509	RHEL 9 : ruby (RHSA-2024:10964)	Nessus	Red Hat Local Security Checks	12/11/2024	12/11/2024	high
232936	RockyLinux 9 : ruby (RLSA-2024:10858)	Nessus	Rocky Linux Local Security Checks	3/19/2025	3/19/2025	high
234686	Ubuntu 16.04 LTS / 18.04 LTS : Ruby vulnerabilities (USN-7442-1)	Nessus	Ubuntu Local Security Checks	4/21/2025	4/21/2025	high
211674	Ubuntu 20.04 LTS : Ruby vulnerabilities (USN-7091-2)	Nessus	Ubuntu Local Security Checks	11/21/2024	12/23/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high