Skip to content

Translate CVE-2025-58767 (zh_cn) #3627

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 30, 2025
Merged

Translate CVE-2025-58767 (zh_cn) #3627

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions zh_cn/news/_posts/2025-09-18-dos-rexml-cve-2025-58767.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
---
layout: news_post
title: "CVE-2025-58767: REXML 中的拒绝服务攻击漏洞"
author: "naitoh"
translator: GAO Jun
date: 2025-09-18 03:00:00 +0000
tags: security
lang: zh_cn
---

在 REXML gem 中存在一个拒绝服务漏洞。此漏洞的 CVE 编号为 [CVE-2025-58767](https://www.cve.org/CVERecord?id=CVE-2025-58767)。我们强烈建议您更新 REXML gem。

## 详情

如果一个无效 XML 中包含多个 XML 声明，则在解析时会增加执行时间和内存使用。
请将 REXML gem 更新到 3.4.2 或后续版本。

## 受影响版本

* REXML gem 3.3.3 至 3.4.1

## 致谢

感谢 [Sofi Aberegg](https://github.com/sofiaaberegg) 发现此问题。

## 历史

* 最初发布于 2025-09-18 03:00:00 (UTC)
Loading