CVE-2025-10990
Fixed in a distro release EPSS <1%CVSS 7.5
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
Products: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9, Red Hat Satellite Client 6 for RHEL 8, Red Hat Satellite Client 6 for RHEL 9
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | rexml | 3.3.9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat rhel satellite client 6 | puppet-agent | 0:7.34.0-4.el9sat |
| Red Hat rhel satellite client 6 | puppet-agent | 0:7.34.0-4.el8sat |
| Red Hat satellite 6.16 | cjson | 0:1.7.18-2.el8sat |
| Red Hat satellite 6.16 | cjson | 0:1.7.18-2.el9sat |
| Red Hat satellite 6.16 | cjson-debuginfo | 0:1.7.18-2.el9sat |
| Red Hat satellite 6.16 | cjson-debuginfo | 0:1.7.18-2.el8sat |
| Red Hat satellite 6.16 | cjson-debugsource | 0:1.7.18-2.el8sat |
| Red Hat satellite 6.16 | cjson-debugsource | 0:1.7.18-2.el9sat |
| Red Hat satellite 6.16 | puppet-agent | 0:8.8.1-3.el9sat |
| Red Hat satellite 6.16 | puppet-agent | 0:8.8.1-3.el8sat |
| Red Hat satellite 6.16 | python-django | 0:4.2.24-0.1.el9pc |
| Red Hat satellite 6.16 | python-django | 0:4.2.24-0.1.el8pc |
| Red Hat satellite 6.16 | python3.11-django | 0:4.2.24-0.1.el8pc |
| Red Hat satellite 6.16 | python3.11-django | 0:4.2.24-0.1.el9pc |
| Red Hat satellite 6.17 | cjson | 0:1.7.18-2.el9sat |
| Red Hat satellite 6.17 | cjson-debuginfo | 0:1.7.18-2.el9sat |
| Red Hat satellite 6.17 | cjson-debugsource | 0:1.7.18-2.el9sat |
| Red Hat satellite 6.17 | puppet-agent | 0:8.8.1-3.el9sat |
| Red Hat satellite 6.17 | python-django | 0:4.2.24-0.1.el9pc |
| Red Hat satellite 6.17 | python3.11-django | 0:4.2.24-0.1.el9pc |
| Red Hat satellite capsule 6.16 | cjson | 0:1.7.18-2.el8sat |
| Red Hat satellite capsule 6.16 | cjson | 0:1.7.18-2.el9sat |
| Red Hat satellite capsule 6.16 | cjson-debuginfo | 0:1.7.18-2.el8sat |
| Red Hat satellite capsule 6.16 | cjson-debuginfo | 0:1.7.18-2.el9sat |
| Red Hat satellite capsule 6.16 | cjson-debugsource | 0:1.7.18-2.el8sat |
| Red Hat satellite capsule 6.16 | cjson-debugsource | 0:1.7.18-2.el9sat |
| Red Hat satellite capsule 6.16 | puppet-agent | 0:8.8.1-3.el8sat |
| Red Hat satellite capsule 6.16 | puppet-agent | 0:8.8.1-3.el9sat |
| Red Hat satellite capsule 6.16 | python-django | 0:4.2.24-0.1.el8pc |
| Red Hat satellite capsule 6.16 | python-django | 0:4.2.24-0.1.el9pc |
| Red Hat satellite capsule 6.16 | python3.11-django | 0:4.2.24-0.1.el9pc |
| Red Hat satellite capsule 6.16 | python3.11-django | 0:4.2.24-0.1.el8pc |
| Red Hat satellite capsule 6.17 | cjson | 0:1.7.18-2.el9sat |
| Red Hat satellite capsule 6.17 | cjson-debuginfo | 0:1.7.18-2.el9sat |
| Red Hat satellite capsule 6.17 | cjson-debugsource | 0:1.7.18-2.el9sat |
| Red Hat satellite capsule 6.17 | puppet-agent | 0:8.8.1-3.el9sat |
| Red Hat satellite capsule 6.17 | python-django | 0:4.2.24-0.1.el9pc |
| Red Hat satellite capsule 6.17 | python3.11-django | 0:4.2.24-0.1.el9pc |
| Ubuntu 16.04 LTS | jruby | no fix |
| Ubuntu 18.04 LTS | jruby | no fix |
| Ubuntu 20.04 LTS | jruby | no fix |
| Ubuntu 22.04 LTS | ruby3.0 | no fix |
| Ubuntu 24.04 LTS | jruby | no fix |
| Ubuntu 24.04 LTS | ruby3.2 | no fix |
| Ubuntu 25.10 | jruby | no fix |
| Ubuntu 25.10 | ruby3.3 | no fix |
| Ubuntu 26.04 LTS | jruby | no fix |
| Ubuntu 26.04 LTS | ruby3.3 | no fix |
| Ubuntu 26.10 | jruby | no fix |
| Ubuntu 26.10 | ruby3.3 | no fix |
| Ubuntu Pro 14.04 LTS | jruby | no fix |
| Ubuntu Pro 16.04 LTS | ruby2.3 | no fix |
| Ubuntu Pro 18.04 LTS | ruby2.5 | no fix |
| Ubuntu Pro 20.04 LTS | ruby2.7 | no fix |