CVE-2025-10990: Inefficient Regular Expression Complexity
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
AI Analysis
Technical Summary
CVE-2025-10990 is a Regular Expression Denial of Service (ReDoS) vulnerability in the REXML library. It arises from inefficient regex parsing when processing hex numeric character references (&#x...;) in XML documents. This vulnerability is due to an incomplete fix for CVE-2024-49761. The issue affects Red Hat Satellite and related packages, including puppet-agent, and has been addressed in updated releases of Red Hat Satellite 6.16 and 6.17 for RHEL 8 and 9. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only.
Potential Impact
The vulnerability allows a remote attacker to cause a denial of service by exploiting inefficient regex processing in REXML, impacting the availability of the affected system. There is no impact on confidentiality or integrity. The issue affects Red Hat Satellite and related components, potentially causing service disruption.
Mitigation Recommendations
Red Hat has released security updates for Red Hat Satellite 6.16 and 6.17 on RHEL 8 and 9 that include a fix for this vulnerability. Users should apply these updates after ensuring all previously released errata relevant to their systems are applied. Detailed update instructions are available in the Red Hat Satellite documentation. Since this is an incomplete fix of a prior CVE, applying the latest patches is critical to fully remediate the issue.
CVE-2025-10990: Inefficient Regular Expression Complexity
Description
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
CVSS v3.1
Score 7.5high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-10990 is a Regular Expression Denial of Service (ReDoS) vulnerability in the REXML library. It arises from inefficient regex parsing when processing hex numeric character references (&#x...;) in XML documents. This vulnerability is due to an incomplete fix for CVE-2024-49761. The issue affects Red Hat Satellite and related packages, including puppet-agent, and has been addressed in updated releases of Red Hat Satellite 6.16 and 6.17 for RHEL 8 and 9. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only.
Potential Impact
The vulnerability allows a remote attacker to cause a denial of service by exploiting inefficient regex processing in REXML, impacting the availability of the affected system. There is no impact on confidentiality or integrity. The issue affects Red Hat Satellite and related components, potentially causing service disruption.
Mitigation Recommendations
Red Hat has released security updates for Red Hat Satellite 6.16 and 6.17 on RHEL 8 and 9 that include a fix for this vulnerability. Users should apply these updates after ensuring all previously released errata relevant to their systems are applied. Detailed update instructions are available in the Red Hat Satellite documentation. Since this is an incomplete fix of a prior CVE, applying the latest patches is critical to fully remediate the issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2025-09-25T17:30:55.821Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/errata/RHSA-2025:17606","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:17613","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:17693","vendor":"Red Hat"},{"url":"https://access.redhat.com/security/cve/CVE-2025-10990","vendor":"Red Hat"}]
Threat ID: 69a19ef732ffcdb8a232d2bb
Added to database: 02/27/2026, 13:41:11 UTC
Last enriched: 06/26/2026, 12:26:49 UTC
Last updated: 07/31/2026, 19:22:52 UTC
Views: 301
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.