CVE-2014-8090

What it actually does

The REXML parser fails to limit entity expansion in XML documents containing an empty entity referenced through deep nesting, resulting in exponential growth that exhausts CPU and memory.

Why it matters to the business

Applications built on affected Ruby versions can be rendered unavailable by resource exhaustion, leading to service outages, degraded performance, and increased operational costs until the parser is updated.

How an attack unfolds

An attacker crafts an XML document that defines an empty entity and references it recursively many times, then submits it to any Ruby application endpoint that uses REXML for parsing; the incomplete mitigation from prior CVEs allows the expansion to proceed unchecked until the process consumes available resources.

How to fix it

Upgrade Ruby to 1.9.3 patchlevel 551 or newer, 2.0.0 patchlevel 598 or newer, or 2.1.5 or newer; replace REXML usage with a hardened parser where feasible and apply strict XML input validation or size limits as an interim control.

How to confirm the fix worked

Verify the installed Ruby version meets or exceeds the patched patchlevels; replay a known XEE test document against the application and confirm that resource usage remains bounded and no crash occurs.

Typical attack path

1. Locate a network-accessible Ruby application that accepts and parses untrusted XML via REXML
2. Generate a minimal XML payload containing an empty entity used in a large number of nested references
3. Transmit the payload to the target parser
4. Observe sustained high CPU and memory consumption leading to denial of service

How to detect it

Inspect web server and application logs for spikes in CPU or memory correlated with XML POST or PUT requests; search request bodies and logs for repeated entity declarations or unusually deep entity references; monitor process trees for Ruby instances showing sustained high resource utilization during XML handling.

• XML containing <!ENTITY .* "".*&.*;> patterns with high nesting depth
• REXML parser process exhibiting >90% CPU for extended periods on XML input
• Request logs showing XML payloads exceeding normal size with repeated entity references

What your security team should do

• Prioritize immediate upgrade of all Ruby runtimes to the listed patched releases
• Add network-level or application-level XML schema and size restrictions to block expansion attacks
• Enable resource accounting and alerting on processes that perform XML parsing
• Review and retire any remaining use of the legacy REXML parser in favor of safer alternatives