REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-rssUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-mysql2-docUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-rexmlUpgrade ruby-develUpgrade ruby-bundled-gemsUpgrade rubygem-bundlerUpgrade rubygem-rbsUpgrade rubygem-raccUpgrade rubygem-abrtUpgrade rubygem-jsonUpgrade ruby-default-gemsUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygem-typeprofUpgrade ruby-libsUpgrade rubygemsUpgrade rubygem-abrt-doc | Sep 23, 2024 | Jul 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Jul 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2Upgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-docUpgrade ruby3.2-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-debugsourceUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-test-unit | Apr 2, 2025 | Jul 16, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Jan 20, 2025 | Jul 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Nov 11, 2024 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Dec 12, 2024 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jan 15, 2025 | Jul 16, 2024 |
| Oracle_linux | — | Upgrade rubygem-io-consoleUpgrade rubygem-rssUpgrade rubygem-psychUpgrade rubygem-power_assertUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-typeprofUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubygem-irbUpgrade rubygem-pg-docUpgrade ruby-default-gemsUpgrade rubyUpgrade rubygem-rakeUpgrade rubygem-raccUpgrade rubygem-rbsUpgrade ruby-develUpgrade rubygem-rexmlUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade rubygem-abrt | Oct 16, 2024 | Jul 16, 2024 |
| Redhat_linux | — | Upgrade rubygem-rdocUpgrade rubygem-abrt-docUpgrade rubygems-develUpgrade rubygem-rbs-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-psych-debuginfoUpgrade rubygem-rakeUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-raccUpgrade rubygem-typeprofUpgrade rubygem-io-console-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-pg-debugsourceUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade rubygemsUpgrade rubygem-jsonNo solution existsUpgrade rubygem-irbUpgrade rubygem-power_assertUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade ruby-libs-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade ruby-default-gemsUpgrade ruby-bundled-gemsUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-abrtUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-develUpgrade rubygem-bundler | Sep 20, 2024 | Jul 16, 2024 |
| Rocky_linux | — | Upgrade ruby-bundled-gemsUpgrade rubygem-rbsUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade rubygem-raccUpgrade rubygem-pg-debugsourceUpgrade rubygem-psychUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygem-mysql2Upgrade rubygem-racc-debuginfoUpgrade rubygem-pgUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade rubyUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfo | Oct 2, 2024 | Jul 16, 2024 |
| Suse | — | Upgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5Upgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-develUpgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-ri | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade libruby3.2Upgrade ruby2.7Upgrade libruby2.7Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby3.2Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.0Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.3Upgrade libruby3.0Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby3.3 | Nov 6, 2024 | Jul 16, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub