REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygemsUpgrade rubygem-typeprofUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygem-bigdecimalUpgrade rubygem-power_assertUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-docUpgrade pcsUpgrade rubygems-develUpgrade rubygem-rssUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade ruby-default-gemsUpgrade ruby-docUpgrade ruby-libsUpgrade rubygem-raccUpgrade pcs-snmpUpgrade rubyUpgrade rubygem-rbsUpgrade rubygem-rakeUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade rubygem-rexml | Sep 18, 2024 | Sep 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Aug 1, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2Upgrade ruby3.2-debugsourceUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-libsUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygems | Apr 2, 2025 | Aug 1, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Jan 20, 2025 | Aug 1, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Nov 11, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Dec 12, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jan 15, 2025 | Aug 1, 2024 |
| Oracle_linux | — | Upgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-abrt-docUpgrade rubygem-raccUpgrade rubygem-bundlerUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade ruby-bundled-gemsUpgrade ruby-default-gemsUpgrade rubygem-pg-docUpgrade rubyUpgrade rubygem-rssUpgrade ruby-libsUpgrade pcs-snmpUpgrade rubygem-rakeUpgrade ruby-docUpgrade rubygem-rbsUpgrade rubygem-irbUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-typeprofUpgrade rubygem-rdocUpgrade pcsUpgrade rubygem-rexml | Oct 16, 2024 | Aug 1, 2024 |
| Redhat_linux | — | Upgrade rubygem-mysql2Upgrade rubygem-mysql2-debuginfoUpgrade pcs-snmpUpgrade rubygem-rakeUpgrade rubygem-rbsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-rbs-debuginfoUpgrade rubygem-rssUpgrade rubygem-irbUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade rubygem-rexmlUpgrade ruby-docNo solution existsUpgrade rubygem-bundlerUpgrade rubygem-pg-debugsourceUpgrade rubygem-raccUpgrade rubyUpgrade rubygemsUpgrade rubygem-abrt-docUpgrade ruby-libsUpgrade ruby-default-gemsUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-pgUpgrade rubygem-power_assertUpgrade rubygem-psych-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygems-develUpgrade rubygem-typeprofUpgrade ruby-libs-debuginfoUpgrade pcsUpgrade rubygem-pg-docUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rdocUpgrade rubygem-mysql2-doc | Sep 18, 2024 | Aug 1, 2024 |
| Rocky_linux | — | Upgrade rubygem-raccUpgrade ruby-develUpgrade rubyUpgrade ruby-libs-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-racc-debuginfoUpgrade pcsUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade ruby-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-io-consoleUpgrade pcs-snmpUpgrade ruby-debugsourceUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rbsUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-pg-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-json | Sep 17, 2024 | Aug 1, 2024 |
| Suse | — | Upgrade ruby2.5-develUpgrade ruby2.5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5-doc-riUpgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-stdlibUpgrade ruby2.5-rubygem-rexml | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.3Upgrade libruby2.7Upgrade ruby2.7Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.3Upgrade libruby3.2Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby3.2Upgrade ruby3.0Upgrade libruby3.0 | Nov 6, 2024 | Aug 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub