REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcs-snmpUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade rubygem-mongo-docUpgrade ruby-libsUpgrade rubygem-xmlrpcUpgrade rubygems-develUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-bsonUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade rubygem-pg-docUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubygem-bson-docUpgrade rubygem-rdocUpgrade rubygem-abrtUpgrade rubygem-net-telnetUpgrade pcsUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-power_assertUpgrade rubygem-jsonUpgrade rubygem-mongoUpgrade rubygem-bundler-docUpgrade rubygem-mysql2Upgrade rubygem-mysql2-docUpgrade rubygem-minitestUpgrade rubygem-abrt-docUpgrade rubygems | Jul 19, 2024 | May 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-libsUpgrade ruby3.2Upgrade ruby3.2-rubygem-psychUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-develUpgrade ruby3.2-rubygemsUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-default-gemsUpgrade ruby3.2-bundled-gems | Apr 2, 2025 | May 16, 2024 |
| Debian | — | Upgrade ruby2.7 | Jan 20, 2025 | May 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | May 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Nov 11, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Oct 9, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Nov 11, 2024 | May 16, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-bundlerUpgrade pcs-snmpUpgrade ruby-docUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-mongo-docUpgrade rubygem-rakeUpgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade rubygem-did_you_meanUpgrade ruby-develUpgrade rubygem-pg-docUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygemsUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-xmlrpcUpgrade rubygem-jsonUpgrade pcsUpgrade rubygem-rdocUpgrade ruby-libsUpgrade rubygem-net-telnetUpgrade rubygem-mongoUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade rubygem-bundler-docUpgrade rubygem-abrtUpgrade rubygem-mysql2 | Aug 16, 2024 | May 16, 2024 |
| Redhat_linux | — | Upgrade rubygem-net-telnetUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade pcsUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubygem-power_assertUpgrade rubygem-mongoNo solution existsUpgrade rubygem-mysql2-debuginfoUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-jsonUpgrade rubygem-pg-debugsourceUpgrade ruby-develUpgrade rubygem-bsonUpgrade rubygem-bundler-docUpgrade rubygem-bson-debugsourceUpgrade rubygem-abrtUpgrade ruby-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-rakeUpgrade rubygem-openssl-debuginfoUpgrade ruby-debuginfoUpgrade pcs-snmpUpgrade rubygem-did_you_meanUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygems-develUpgrade ruby-irbUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade ruby-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-test-unit | Jul 16, 2024 | May 16, 2024 |
| Rocky_linux | — | Upgrade ruby-develUpgrade pcs-snmpUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-io-console-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade pcsUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubyUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade rubygem-pgUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bsonUpgrade rubygem-jsonUpgrade rubygem-pg-debugsource | Jul 16, 2024 | May 16, 2024 |
| Suse | — | Upgrade ruby2.5-docUpgrade ruby2.5-rubygem-rexml-docUpgrade libruby2_5-2_5Upgrade ruby2.5-doc-riUpgrade ruby2.5-develUpgrade ruby2.5-stdlibUpgrade ruby2.5-devel-extraUpgrade ruby2.5Upgrade ruby2.5-rubygem-rexml | Dec 5, 2025 | Sep 18, 2024 |
| Ubuntu | — | Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.7Upgrade ruby3.0Upgrade libruby3.2Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby3.2Upgrade libruby3.0Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.3Upgrade ruby3.3Upgrade libruby2.7 | Nov 6, 2024 | May 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub