The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-typeprofUpgrade rubygem-pgUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade pcsUpgrade pcs-snmpUpgrade rubygem-rbsUpgrade rubygem-abrtUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade rubyUpgrade ruby-develUpgrade ruby-libsUpgrade ruby-default-gemsUpgrade ruby-docUpgrade rubygem-raccUpgrade rubygem-psychUpgrade rubygem-rexmlUpgrade rubygem-rssUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade ruby-bundled-gems | Sep 18, 2024 | Sep 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Aug 1, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygems-develUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2Upgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-debugsourceUpgrade ruby3.2-develUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-rss | Apr 2, 2025 | Aug 1, 2024 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Jan 20, 2025 | Aug 1, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Nov 11, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Dec 12, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Jan 15, 2025 | Aug 1, 2024 |
| Oracle_linux | — | Upgrade pcsUpgrade rubygem-rdocUpgrade rubygem-pgUpgrade rubygem-bigdecimalUpgrade ruby-develUpgrade rubygemsUpgrade rubygem-test-unitUpgrade rubygem-typeprofUpgrade rubygem-rexmlUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubyUpgrade rubygem-power_assertUpgrade rubygem-rbsUpgrade pcs-snmpUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade ruby-docUpgrade ruby-default-gemsUpgrade ruby-bundled-gemsUpgrade rubygem-abrt-docUpgrade rubygem-irbUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubygem-raccUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygem-rssUpgrade rubygem-pg-docUpgrade rubygem-rake | Oct 16, 2024 | Aug 1, 2024 |
| Redhat_linux | — | Upgrade rubygem-mysql2-debugsourceUpgrade rubygem-racc-debuginfoUpgrade rubygem-abrtNo solution existsUpgrade rubygem-rexmlUpgrade rubygem-rbsUpgrade rubygem-pg-debugsourceUpgrade ruby-develUpgrade rubygem-rbs-debuginfoUpgrade rubygem-raccUpgrade rubygem-test-unitUpgrade rubygem-mysql2Upgrade rubygem-irbUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade rubygem-rakeUpgrade rubygem-io-console-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-io-consoleUpgrade ruby-bundled-gemsUpgrade pcs-snmpUpgrade rubygem-rssUpgrade rubygem-psychUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pgUpgrade pcsUpgrade rubygem-abrt-docUpgrade rubygem-typeprofUpgrade rubygemsUpgrade rubygem-power_assertUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-docUpgrade ruby-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-rdocUpgrade ruby-libsUpgrade rubygems-develUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade ruby-default-gemsUpgrade ruby-bundled-gems-debuginfo | Sep 18, 2024 | Aug 1, 2024 |
| Rocky_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-pgUpgrade rubygem-pg-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubyUpgrade ruby-develUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-libs-debuginfoUpgrade pcsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-raccUpgrade rubygem-jsonUpgrade rubygem-rbs-debuginfoUpgrade ruby-debugsourceUpgrade pcs-snmpUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2Upgrade rubygem-rbsUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2-debugsource | Sep 17, 2024 | Aug 1, 2024 |
| Suse | — | Upgrade ruby2.5-doc-riUpgrade ruby2.5-develUpgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-stdlib | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade libruby3.2Upgrade ruby3.0Upgrade ruby3.2Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby2.7Upgrade ruby3.3Upgrade libruby3.3Upgrade libruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro) | Nov 6, 2024 | Aug 1, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub