The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mongo-docUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade ruby-docUpgrade rubygem-bundlerUpgrade pcs-snmpUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubyUpgrade rubygem-rssUpgrade rubygem-psychUpgrade rubygem-rexmlUpgrade rubygem-net-telnetUpgrade rubygem-bsonUpgrade rubygem-typeprofUpgrade rubygem-test-unitUpgrade rubygem-opensslUpgrade rubygem-rbsUpgrade rubygem-abrt-docUpgrade pcsUpgrade rubygem-pgUpgrade ruby-default-gemsUpgrade rubygem-mongoUpgrade rubygem-jsonUpgrade rubygem-bundler-docUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-mysql2-docUpgrade ruby-libsUpgrade rubygem-bson-docUpgrade ruby-bundled-gemsUpgrade rubygem-xmlrpcUpgrade rubygem-rdoc | Dec 10, 2024 | Oct 28, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Oct 28, 2024 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 4, 2025 | Nov 3, 2025 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Jan 20, 2025 | Oct 28, 2024 |
| Dell Powerstore Dsa2025342 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Oct 28, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jan 14, 2025 | Oct 28, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Feb 11, 2025 | Oct 28, 2024 |
| Oracle_linux | — | Upgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-pgUpgrade rubygem-power_assertUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade rubygem-minitestUpgrade rubygem-typeprofUpgrade pcsUpgrade rubygem-pg-docUpgrade rubygem-bundler-docUpgrade ruby-default-gemsUpgrade rubygem-bson-docUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-irbUpgrade rubygem-abrtUpgrade rubygem-io-consoleUpgrade rubygem-test-unitUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubygem-did_you_meanUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-bsonUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2Upgrade ruby-develUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade ruby-bundled-gemsUpgrade pcs-snmpUpgrade ruby-irbUpgrade rubygem-xmlrpcUpgrade rubygem-rexmlUpgrade rubygem-mongo-doc | Dec 6, 2024 | Oct 28, 2024 |
| Redhat_linux | — | Upgrade rubygem-rdocUpgrade rubygem-pg-docUpgrade ruby-docUpgrade rubygem-xmlrpcUpgrade rubygemsUpgrade rubygem-pg-debugsourceUpgrade rubygem-mongoUpgrade rubygem-minitestUpgrade rubygem-opensslUpgrade ruby-libs-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-bundler-docUpgrade rubygem-mysql2-docUpgrade ruby-bundled-gems-debuginfoUpgrade pcsUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade rubyUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rbsUpgrade ruby-default-gemsUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygem-power_assertUpgrade rubygem-irbUpgrade rubygem-psych-debuginfoUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-did_you_meanUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-docUpgrade rubygem-mongo-docUpgrade pcs-snmpUpgrade rubygem-rexmlUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bsonUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygem-typeprofUpgrade rubygem-pg-debuginfoUpgrade ruby-debugsourceNo solution existsUpgrade rubygem-rssUpgrade rubygem-rakeUpgrade rubygem-mysql2-debugsourceUpgrade ruby-bundled-gemsUpgrade ruby-irbUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bson-debuginfo | Feb 10, 2025 | Oct 28, 2024 |
| Rocky_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-opensslUpgrade pcsUpgrade rubyUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-develUpgrade rubygem-rbsUpgrade rubygem-pgUpgrade pcs-snmpUpgrade ruby-debugsourceUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-bundled-gemsUpgrade ruby-libsUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-json | Feb 5, 2026 | Jul 29, 2025 |
| Ubuntu | — | Upgrade libruby3.0Upgrade ruby3.0Upgrade ruby2.7Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby3.2Upgrade libruby3.2Upgrade libruby3.3Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby3.3Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.7 | Nov 6, 2024 | Oct 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 28, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub