deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-jw9c-mfg7-9rx2
Package: ruby-saml (RUBYGEMS)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 1.13.0, < 1.17.0
Patched in: 1.17.0

Summary: SAML authentication bypass via Incorrect XPath selector

Details:
Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system.

This vulnerability was reported by ahacker1 of SecureSAML (ahacker1@securesaml.com)
GitHub Security Advisory: GHSA-jw9c-mfg7-9rx2
Package: ruby-saml (RUBYGEMS)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 1.12.3
Patched in: 1.12.3

Summary: SAML authentication bypass via Incorrect XPath selector

Details:
Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system.

This vulnerability was reported by ahacker1 of SecureSAML (ahacker1@securesaml.com)
GitHub Security Advisory: GHSA-vc8w-jr9v-vj7f
Package: bootstrap (RUBYGEMS)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0, <= 4.6.2
Patched in: 5.0.0

Summary: Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability

Details:
## Withdrawn Advisory
This advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.

## Original Descripton

A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an <a> tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
GitHub Security Advisory: GHSA-frp2-5qfc-7r8m
Package: request_store (RUBYGEMS)
Severity: MODERATE (CVSS 7.8)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: = 1.3.2
Patched in: 1.4.0

Summary: request_store has Incorrect Default Permissions

Details:
### Impact

The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code.

This version was published in 2017, and most production environments do not allow access for local users, so the chances of this being exploited are very low, given that the vast majority of users will have upgraded, and those that have not, if any, are not likely to be exposed.

### Patches

I am not aware of any other version of the gem with incorrect permissions, so simply upgrading should fix the issue.

### Workarounds

You could chmod the files yourself, I guess.

### References

https://cwe.mitre.org/data/definitions/276.html
GitHub Security Advisory: GHSA-vmwr-mc7x-5vc3
Package: rexml (RUBYGEMS)
Severity: HIGH (CVSS 5.9)
CWE: CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Vulnerable versions: < 3.3.6
Patched in: 3.3.6

Summary: REXML denial of service vulnerability

Details:
### Impact

The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes.

If you need to parse untrusted XMLs with tree parser API like `REXML::Document.new`, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected.

### Patches

The REXML gem 3.3.6 or later include the patch to fix the vulnerability.

### Workarounds

Don't parse untrusted XMLs with tree parser API.

### References

* https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398/ : An announce on www.ruby-lang.org
GitHub Security Advisory: GHSA-hj56-84jw-67h6
Package: bindata (RUBYGEMS)
Severity: MODERATE (CVSS 3.7)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2.4.10
Patched in: 2.4.10

Summary: Potential Denial-of-Service in bindata

Details:
In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example `BinData::Bit100000`, `BinData::Bit100001`, `BinData::Bit100002`, `BinData::Bit<N>`. In combination with `<user_input>.constantize` there is a potential for a CPU-based DoS. In version 2.4.10, bindata improved the creation time of Bits and Integers.
GitHub Security Advisory: GHSA-592j-995h-p23j
Package: rdoc (RUBYGEMS)
Severity: LOW (CVSS 4.5)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 6.3.3, < 6.3.4.1
Patched in: 6.3.4.1

Summary: RDoc RCE vulnerability with .rdoc_options

Details:
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.

When parsing `.rdoc_options` (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored.

When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.

We recommend to update the RDoc gem to version 6.6.3.1 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

* For Ruby 3.0 users: Update to `rdoc` 6.3.4.1
* For Ruby 3.1 users: Update to `rdoc` 6.4.1.1
* For Ruby 3.2 users: Update to `rdoc` 6.5.1.1

You can use `gem update rdoc` to update it. If you are using bundler, please add `gem "rdoc", ">= 6.6.3.1"` to your `Gemfile`.

Note: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.
GitHub Security Advisory: GHSA-2m96-52r3-2f3g
Package: fugit (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.11.1
Patched in: 1.11.1

Summary: fugit parse and parse_nat stall on lengthy input

Details:
### Impact

The fugit "natural" parser, that turns "every wednesday at 5pm" into "0 17 * * 3", accepted any length of input and went on attempting to parse it, not returning promptly, as expected. The parse call could hold the thread with no end in sight.

Fugit dependents that do not check (user) input length for plausability are impacted.

### Patches

Problem was reported in #104 and the fix was released in [fugit 1.11.1](https://rubygems.org/gems/fugit/versions/1.11.1)

### Workarounds

By making sure that `Fugit.parse(s)`, `Fugit.do_parse(s)`, `Fugit.parse_nat(s)`, `Fugit.do_parse_nat(s)`, `Fugit::Nat.parse(s)`, and `Fugit::Nat.do_parse(s)` are not fed strings too long. 1000 chars feels ok, while 10_000 chars makes it stall.

In fewer words, making sure those fugit methods are not fed unvetted input strings.

### References

gh-104
GitHub Security Advisory: GHSA-qv32-5wm2-p32h
Package: sequenceserver (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: < 3.1.2
Patched in: 3.1.2

Summary: Command Injection in sequenceserver

Details:
### Impact

Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands

### Patches

Fixed in 3.1.2

### Workarounds

No known workarounds
GitHub Security Advisory: GHSA-wqw3-p83g-r24v
Package: spina (RUBYGEMS)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: <= 2.18.0
Patched in: unpatched

Summary: Cross-Site Request Forgery in Spina

Details:
A vulnerability classified as problematic was found in Spina CMS 2.18.0. Affected by this vulnerability is an unknown functionality of the file /admin/media_folders. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272431. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-3wqf-4x89-9g79
Package: bootstrap-sass (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.3.0, < 3.4.0
Patched in: 3.4.0

Summary: Bootstrap vulnerable to Cross-Site Scripting (XSS)

Details:
In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.
GitHub Security Advisory: GHSA-5866-49gr-22v4
Package: rexml (RUBYGEMS)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 3.3.3
Patched in: 3.3.3

Summary: REXML DoS vulnerability

Details:
### Impact

The REXML gem before 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API.

If you need to parse untrusted XMLs with SAX2 or pull parser API, you may be impacted to this vulnerability.

### Patches

The REXML gem 3.3.3 or later include the patch to fix the vulnerability.

### Workarounds

Don't parse untrusted XMLs with SAX2 or pull parser API.

### References

* https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/ : This is a similar vulnerability
* https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946/: An announce on www.ruby-lang.org
GitHub Security Advisory: GHSA-r55c-59qm-vjw6
Package: rexml (RUBYGEMS)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 3.3.3
Patched in: 3.3.3

Summary: REXML DoS vulnerability

Details:
### Impact

The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`.

If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.

### Patches

The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.

### Workarounds

Don't parse untrusted XMLs.

### References

* https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability
* https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8 : This is a similar vulnerability
* https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123/: An announce on www.ruby-lang.org
GitHub Security Advisory: GHSA-9mvj-f7w8-pvh2
Package: bootstrap-sass (RUBYGEMS)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, <= 3.4.1
Patched in: unpatched

Summary: Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability

Details:
## Withdrawn Advisory
This advisory has been withdrawn because it was determined to not be a vulnerability in Bootstrap. From the CVE:

> This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.

## Original Description
A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the `data-slide` and `data-slide-to` attributes can be exploited through the href attribute of an `<a>` tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
GitHub Security Advisory: GHSA-9mvj-f7w8-pvh2
Package: bootstrap (RUBYGEMS)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, <= 3.4.1
Patched in: unpatched

Summary: Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability

Details:
## Withdrawn Advisory
This advisory has been withdrawn because it was determined to not be a vulnerability in Bootstrap. From the CVE:

> This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.

## Original Description
A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the `data-slide` and `data-slide-to` attributes can be exploited through the href attribute of an `<a>` tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
GitHub Security Advisory: GHSA-4p24-vmcr-4gqj
Package: bootstrap-sass (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.4, < 3.4.0
Patched in: 3.4.0

Summary: Bootstrap Cross-site Scripting vulnerability

Details:
In Bootstrap 2.x from 2.0.4, 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different vulnerability than CVE-2018-14041.

See https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ for more info.
GitHub Security Advisory: GHSA-4p24-vmcr-4gqj
Package: bootstrap (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.0.0-beta.2
Patched in: 4.0.0-beta.2

Summary: Bootstrap Cross-site Scripting vulnerability

Details:
In Bootstrap 2.x from 2.0.4, 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different vulnerability than CVE-2018-14041.

See https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ for more info.
GitHub Security Advisory: GHSA-pj7m-g53m-7638
Package: bootstrap (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0, < 4.1.2
Patched in: 4.1.2

Summary: Bootstrap Cross-site Scripting vulnerability

Details:
In Bootstrap 4.x before 4.1.2, XSS is possible in the data-target property of scrollspy. This is similar to CVE-2018-14042.
GitHub Security Advisory: GHSA-7mvr-5x2g-wfc8
Package: bootstrap-sass (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.3.0, < 3.4.0
Patched in: 3.4.0

Summary: Bootstrap Cross-site Scripting vulnerability

Details:
In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip.  This is similar to CVE-2018-14041.
GitHub Security Advisory: GHSA-3mgp-fx93-9xv5
Package: bootstrap-sass (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.4.0
Patched in: 3.4.0

Summary: XSS vulnerability that affects bootstrap

Details:
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
GitHub Security Advisory: GHSA-3mgp-fx93-9xv5
Package: bootstrap (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.4.0
Patched in: 3.4.0

Summary: XSS vulnerability that affects bootstrap

Details:
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
GitHub Security Advisory: GHSA-ph58-4vrj-w6hr
Package: bootstrap-sass (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.4.0
Patched in: 3.4.0

Summary: bootstrap Cross-site Scripting vulnerability

Details:
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
GitHub Security Advisory: GHSA-ph58-4vrj-w6hr
Package: bootstrap (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.4.0
Patched in: 3.4.0

Summary: bootstrap Cross-site Scripting vulnerability

Details:
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
GitHub Security Advisory: GHSA-496j-2rq6-j6cc
Package: grpc (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling, CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: >= 1.56.0, < 1.56.2
Patched in: 1.56.2

Summary: Excessive Iteration in gRPC

Details:
gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks:

- Unbounded memory buffering in the HPACK parser
- Unbounded CPU consumption in the HPACK parser

The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client.

The unbounded memory buffering bugs:

- The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb.
- HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse.
- gRPC’s metadata overflow check was performed per frame, so that the following sequence of frames could cause infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3 etc…
GitHub Security Advisory: GHSA-496j-2rq6-j6cc
Package: grpc (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling, CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: >= 1.55.0, < 1.55.2
Patched in: 1.55.2

Summary: Excessive Iteration in gRPC

Details:
gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks:

- Unbounded memory buffering in the HPACK parser
- Unbounded CPU consumption in the HPACK parser

The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client.

The unbounded memory buffering bugs:

- The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb.
- HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse.
- gRPC’s metadata overflow check was performed per frame, so that the following sequence of frames could cause infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3 etc…
GitHub Security Advisory: GHSA-496j-2rq6-j6cc
Package: grpc (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling, CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: >= 1.54.0, < 1.54.3
Patched in: 1.54.3

Summary: Excessive Iteration in gRPC

Details:
gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks:

- Unbounded memory buffering in the HPACK parser
- Unbounded CPU consumption in the HPACK parser

The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client.

The unbounded memory buffering bugs:

- The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb.
- HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse.
- gRPC’s metadata overflow check was performed per frame, so that the following sequence of frames could cause infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3 etc…
GitHub Security Advisory: GHSA-496j-2rq6-j6cc
Package: grpc (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling, CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: < 1.53.2
Patched in: 1.53.2

Summary: Excessive Iteration in gRPC

Details:
gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks:

- Unbounded memory buffering in the HPACK parser
- Unbounded CPU consumption in the HPACK parser

The unbounded CPU consumption is down to a copy that occurred per-input-block in the parser, and because that could be unbounded due to the memory copy bug we end up with an O(n^2) parsing loop, with n selected by the client.

The unbounded memory buffering bugs:

- The header size limit check was behind the string reading code, so we needed to first buffer up to a 4 gigabyte string before rejecting it as longer than 8 or 16kb.
- HPACK varints have an encoding quirk whereby an infinite number of 0’s can be added at the start of an integer. gRPC’s hpack parser needed to read all of them before concluding a parse.
- gRPC’s metadata overflow check was performed per frame, so that the following sequence of frames could cause infinite buffering: HEADERS: containing a: 1 CONTINUATION: containing a: 2 CONTINUATION: containing a: 3 etc…
GitHub Security Advisory: GHSA-4xqq-m2hx-25v8
Package: rexml (RUBYGEMS)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 3.3.2
Patched in: 3.3.2

Summary: REXML denial of service vulnerability

Details:
### Impact

The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`.

If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.

### Patches

The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities.

### Workarounds

Don't parse untrusted XMLs.

### References

* https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability
* https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908/