REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
CVSS Details
- CVSS 4.0 Base Score: 6.6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-io-consoleUpgrade rubygem-abrtUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade ruby-develUpgrade pcs-snmpUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade rubygem-bundlerUpgrade ruby-irbUpgrade rubygem-mongo-docUpgrade rubyUpgrade rubygem-pg-docUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-irbUpgrade rubygem-pgUpgrade rubygem-minitestUpgrade rubygem-bundler-docUpgrade rubygem-test-unitUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade rubygem-jsonUpgrade rubygem-opensslUpgrade ruby-libsUpgrade rubygem-mysql2-docUpgrade rubygem-bson-docUpgrade ruby-default-gemsUpgrade rubygem-rexmlUpgrade rubygem-xmlrpcUpgrade rubygem-bsonUpgrade rubygem-typeprofUpgrade rubygem-mysql2Upgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade pcsUpgrade ruby-bundled-gemsUpgrade rubygems | Dec 10, 2024 | Oct 28, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Oct 28, 2024 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 4, 2025 | Nov 3, 2025 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Jan 20, 2025 | Oct 28, 2024 |
| Dell Powerstore Dsa2025342 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Oct 28, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Jan 14, 2025 | Oct 28, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Feb 11, 2025 | Oct 28, 2024 |
| Oracle_linux | — | Upgrade rubygem-rssUpgrade rubygem-test-unitUpgrade rubygem-mysql2Upgrade rubygem-mysql2-docUpgrade rubygem-rbsUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade pcs-snmpUpgrade rubygem-xmlrpcUpgrade rubygem-abrtUpgrade rubygem-mongo-docUpgrade rubygem-rexmlUpgrade ruby-bundled-gemsUpgrade rubygem-bundlerUpgrade rubygem-did_you_meanUpgrade rubygem-bsonUpgrade rubygem-rakeUpgrade rubyUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-pg-docUpgrade rubygem-typeprofUpgrade ruby-libsUpgrade rubygem-bson-docUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-net-telnetUpgrade rubygem-mongoUpgrade rubygem-abrt-docUpgrade rubygem-opensslUpgrade rubygem-bundler-docUpgrade ruby-default-gemsUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygems-develUpgrade pcs | Dec 6, 2024 | Oct 28, 2024 |
| Redhat_linux | — | Upgrade rubygem-psychUpgrade rubygem-mongo-docUpgrade ruby-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-rbs-debuginfoNo solution existsUpgrade pcs-snmpUpgrade ruby-bundled-gemsUpgrade ruby-irbUpgrade rubygem-bson-debuginfoUpgrade rubygem-rexmlUpgrade ruby-debugsourceUpgrade rubygem-bson-debugsourceUpgrade ruby-libsUpgrade rubygem-pg-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-json-debuginfoUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade rubygem-rssUpgrade rubygem-bson-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bsonUpgrade rubygems-develUpgrade rubygem-opensslUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade ruby-docUpgrade rubygem-xmlrpcUpgrade rubygemsUpgrade rubygem-pgUpgrade ruby-default-gemsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubyUpgrade rubygem-bundler-docUpgrade ruby-libs-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mongoUpgrade rubygem-irbUpgrade rubygem-net-telnetUpgrade rubygem-rbsUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-psych-debuginfoUpgrade pcsUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-pg-debugsource | Feb 10, 2025 | Oct 28, 2024 |
| Rocky_linux | — | Upgrade pcs-snmpUpgrade rubygem-psychUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-bundled-gemsUpgrade ruby-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-bsonUpgrade rubygem-openssl-debuginfoUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-bson-debuginfoUpgrade rubygem-opensslUpgrade ruby-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rbsUpgrade rubyUpgrade pcsUpgrade rubygem-pg-debugsourceUpgrade ruby-libs-debuginfo | Feb 5, 2026 | Jul 29, 2025 |
| Ubuntu | — | Upgrade ruby3.2Upgrade libruby3.0Upgrade ruby2.7Upgrade libruby3.2Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby3.0Upgrade libruby3.3Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.7Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.3 | Nov 6, 2024 | Oct 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub