REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubyUpgrade rubygem-net-telnetUpgrade pcsUpgrade rubygem-jsonUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade rubygem-bundler-docUpgrade rubygem-mongoUpgrade rubygem-pg-docUpgrade rubygem-abrtUpgrade rubygem-minitestUpgrade rubygem-bsonUpgrade pcs-snmpUpgrade ruby-irbUpgrade rubygems-develUpgrade rubygem-xmlrpcUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-test-unitUpgrade rubygem-did_you_meanUpgrade ruby-libsUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-bigdecimal | Jul 19, 2024 | May 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2Upgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-default-gemsUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-io-console | Apr 2, 2025 | May 16, 2024 |
| Debian | — | Upgrade ruby2.7 | Jan 20, 2025 | May 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | May 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Nov 11, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Oct 9, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Nov 11, 2024 | May 16, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade ruby-develUpgrade ruby-docUpgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade pcs-snmpUpgrade rubygem-mongo-docUpgrade rubygem-pgUpgrade rubygem-bsonUpgrade rubyUpgrade rubygem-rdocUpgrade rubygem-bundler-docUpgrade pcsUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade rubygem-jsonUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-abrtUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade rubygem-bson-docUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade ruby-libs | Aug 16, 2024 | May 16, 2024 |
| Redhat_linux | — | Upgrade rubygem-psych-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-power_assertUpgrade rubygem-bundler-docUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-pg-debugsourceUpgrade ruby-develUpgrade rubygem-bsonNo solution existsUpgrade pcsUpgrade rubygem-bson-debugsourceUpgrade rubygemsUpgrade rubygem-abrtUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-mysql2-docUpgrade rubygem-rdocUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mongoUpgrade rubyUpgrade ruby-libs-debuginfoUpgrade ruby-irbUpgrade rubygem-openssl-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-abrt-docUpgrade ruby-libsUpgrade rubygems-develUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-did_you_meanUpgrade pcs-snmpUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygem-bson-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-xmlrpcUpgrade rubygem-mongo-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-json-debuginfo | Jul 16, 2024 | May 16, 2024 |
| Rocky_linux | — | Upgrade pcsUpgrade rubygem-bsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2Upgrade rubyUpgrade ruby-debugsourceUpgrade rubygem-pgUpgrade ruby-libsUpgrade ruby-libs-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-opensslUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade pcs-snmpUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-io-console-debuginfo | Jul 16, 2024 | May 16, 2024 |
| Suse | — | Upgrade ruby2.5-doc-riUpgrade ruby2.5-develUpgrade ruby2.5Upgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-devel-extraUpgrade ruby2.5-stdlibUpgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5-rubygem-rexml | Dec 5, 2025 | Sep 18, 2024 |
| Ubuntu | — | Upgrade libruby2.7Upgrade ruby3.3Upgrade libruby3.3Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby3.0Upgrade ruby2.7Upgrade libruby3.2Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.7 (Ubuntu Pro) | Nov 6, 2024 | May 16, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub