The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubyUpgrade rubygem-rbsUpgrade rubygem-irbUpgrade rubygem-psychUpgrade ruby-docUpgrade rubygem-mysql2Upgrade rubygem-rexmlUpgrade rubygem-jsonUpgrade rubygem-rssUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-raccUpgrade ruby-bundled-gemsUpgrade pcs-snmpUpgrade rubygem-bundlerUpgrade ruby-default-gemsUpgrade rubygem-rakeUpgrade rubygem-abrtUpgrade pcsUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-mysql2-docUpgrade rubygem-test-unitUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-typeprofUpgrade rubygem-pg | Sep 18, 2024 | Sep 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Aug 1, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-develUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2Upgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-libsUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-bundled-gems | Apr 2, 2025 | Aug 1, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Jan 20, 2025 | Aug 1, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Nov 11, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Dec 12, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jan 15, 2025 | Aug 1, 2024 |
| Oracle_linux | — | Upgrade pcs-snmpUpgrade rubygem-raccUpgrade ruby-libsUpgrade rubygem-abrtUpgrade rubygem-minitestUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-irbUpgrade ruby-docUpgrade rubygem-abrt-docUpgrade rubygem-rakeUpgrade rubygem-rbsUpgrade rubygem-power_assertUpgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade ruby-default-gemsUpgrade rubygem-pg-docUpgrade rubyUpgrade rubygem-rssUpgrade rubygem-test-unitUpgrade rubygem-rexmlUpgrade rubygemsUpgrade rubygems-develUpgrade ruby-develUpgrade pcsUpgrade rubygem-rdocUpgrade rubygem-typeprofUpgrade rubygem-mysql2-docUpgrade rubygem-pgUpgrade rubygem-bigdecimal | Oct 16, 2024 | Aug 1, 2024 |
| Redhat_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-minitestUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-psych-debuginfoUpgrade ruby-libsUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade pcsUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-typeprofUpgrade rubygemsUpgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygem-rexmlUpgrade rubygem-pg-debugsourceUpgrade rubygem-raccUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade rubygem-mysql2-debugsourceUpgrade pcs-snmpUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-rbs-debuginfoUpgrade rubyUpgrade rubygem-io-consoleUpgrade rubygem-io-console-debuginfoUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade ruby-bundled-gemsUpgrade rubygem-abrtUpgrade ruby-docUpgrade ruby-debuginfoNo solution exists | Sep 18, 2024 | Aug 1, 2024 |
| Rocky_linux | — | Upgrade rubygem-bigdecimal-debuginfoUpgrade pcs-snmpUpgrade rubygem-rbs-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade rubygem-rbsUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade ruby-bundled-gemsUpgrade rubygem-json-debuginfoUpgrade rubygem-jsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-raccUpgrade rubygem-racc-debuginfoUpgrade rubyUpgrade rubygem-mysql2-debuginfoUpgrade pcsUpgrade ruby-develUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-io-console-debuginfo | Sep 17, 2024 | Aug 1, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-stdlibUpgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-doc-riUpgrade ruby2.5-devel-extraUpgrade ruby2.5Upgrade ruby2.5-develUpgrade libruby2_5-2_5Upgrade ruby2.5-doc | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade libruby3.0Upgrade ruby3.0Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby3.2Upgrade libruby3.2Upgrade ruby3.3Upgrade libruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.3Upgrade ruby2.7Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro) | Nov 6, 2024 | Aug 1, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub