Is CVE-2024-43398 actively exploited?

No active exploitation of CVE-2024-43398 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-43398 be exploited remotely?

Yes. CVE-2024-43398 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-43398?

CVE-2024-43398 has a CVSS score of 5.9 (MEDIUM).

HOME VULNERABILITIESCVE-2024-43398

MEDIUM

CVE-2024-43398

CWE-776Published: August 22, 2024· Updated: Jun 17, 2026

5.9

CVSS v3.1

Official Description

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability.

NVD Source

Technical Analysis

CVE-2024-43398 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 5.9.