CVE-2025-10990: 
Ruby vulnerability analysis and mitigation

CVE-2025-10990 is a Regular Expression Denial of Service (ReDoS) vulnerability in Ruby's REXML XML parsing library, resulting from an incomplete fix for CVE-2024-49761. A remote, unauthenticated attacker can exploit inefficient regular expression parsing when processing hex numeric character references (&#x...;) in XML documents, causing excessive CPU consumption and denial of service. The vulnerability affects the REXML gem as bundled in puppet-agent packages shipped with Red Hat Satellite 6.15, 6.16, and 6.17, as well as Satellite Client 6 for RHEL 8 and 9. It was reported on September 25, 2025, and patches were issued in October 2025. The CVSS v3.1 base score is 7.5 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity), also mapped to CAPEC-492 (Regular Expression Exponential Blowup). The prior fix for CVE-2024-49761 did not fully address the regex pattern used to parse hex numeric character references (&#x...;) in XML input, leaving a code path susceptible to catastrophic backtracking. An attacker can trigger this by submitting a specially crafted XML document containing malformed or deeply nested hex character references to any service that parses XML using the vulnerable REXML version. No authentication or special privileges are required, and no user interaction is needed (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation causes a denial of service by consuming excessive CPU resources in the affected Ruby process, degrading or completely halting XML parsing operations. The impact is limited to availability — there is no confidentiality or integrity impact. Systems running Red Hat Satellite or Satellite Client that process attacker-controlled XML input (e.g., via Puppet agent catalog requests or Satellite API interactions) are at risk of service disruption (Red Hat RHSA-2025:17606, Red Hat RHSA-2025:17693).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-10990. The vulnerability is remotely exploitable without authentication or user interaction, lowering the barrier for abuse. The EPSS score is approximately 0.147%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report (Red Hat CVE).

1. Identify target: Locate a service that uses the vulnerable REXML gem (e.g., a Red Hat Satellite or Puppet agent endpoint) that accepts or processes XML input from external sources.
2. Craft malicious XML: Construct an XML document containing a large number of hex numeric character references (e.g., &#x followed by a long, ambiguous hex string) designed to trigger catastrophic backtracking in the REXML regex parser.
3. Submit payload: Send the crafted XML document to the target service via HTTP/HTTPS request, Puppet catalog request, or any other XML-consuming interface exposed by the affected component.
4. Trigger ReDoS: The vulnerable regex engine enters exponential backtracking while attempting to parse the hex character references, causing the Ruby process to consume excessive CPU and become unresponsive, resulting in denial of service (Red Hat Bugzilla).

• Network: Unusual or repeated HTTP/HTTPS requests containing XML payloads with large numbers of &#x sequences directed at Satellite or Puppet agent endpoints.
• Process: Ruby or puppet-agent processes exhibiting sustained near-100% CPU utilization without corresponding legitimate workload; process hangs or timeouts during XML parsing operations.
• Logs: Application or Puppet agent logs showing repeated XML parsing errors, timeouts, or unresponsive service warnings; Satellite web server logs with requests containing abnormally large XML bodies.

Red Hat has released patched packages addressing CVE-2025-10990 across multiple advisories issued in October 2025:

• RHSA-2025:17606: Red Hat Satellite 6.17.5 for RHEL 9 (puppet-agent 8.8.1-3.el9sat)
• RHSA-2025:17613: Red Hat Satellite 6.16.5.4 for RHEL 8 and 9 (puppet-agent 8.8.1-3.el8/el9sat)
• RHSA-2025:17693: Satellite Client 6 for RHEL 8 and 9 (puppet-agent 7.34.0-4.el8/el9sat)

Organizations should apply the relevant errata immediately. No configuration-based workaround is documented; upgrading to the patched puppet-agent package is the recommended remediation (Red Hat RHSA-2025:17606, Red Hat RHSA-2025:17613, Red Hat RHSA-2025:17693).

Red Hat classified the vulnerability as Important severity in the context of Satellite 6.16 and 6.17 updates, and Moderate for the standalone Satellite Client update, reflecting the availability-only impact. The issue was noted in German Linux security news (pro-linux.de) covering the Satellite and Satellite Client advisories. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability database aggregation (Red Hat RHSA-2025:17606).