REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.
CVSS Details
- CVSS 4.0 Base Score: 1.2 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygems-develUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygem-abrt-docUpgrade rubygem-rakeUpgrade rubygem-raccUpgrade ruby-libsUpgrade rubygem-rexmlUpgrade rubygemsUpgrade rubygem-minitestUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubygem-power_assertUpgrade rubygem-rssUpgrade rubygem-mysql2-docUpgrade rubygem-rdocUpgrade rubygem-rbsUpgrade ruby-develUpgrade ruby-default-gemsUpgrade ruby-bundled-gemsUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-irbUpgrade rubygem-typeprofUpgrade rubygem-pg-docUpgrade rubygem-abrt | Jan 8, 2026 | Dec 10, 2025 |
| Alpine Linux | — | Upgrade ruby-rexml | Jan 7, 2026 | Sep 17, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-libsUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-develUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-debuginfoUpgrade ruby3.2Upgrade ruby3.2-docUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-bigdecimal | Sep 30, 2025 | Sep 17, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade rubygemsUpgrade rubygem-opensslUpgrade rubyUpgrade rubygem-jsonUpgrade ruby-irbUpgrade rubygem-psych | Mar 17, 2026 | Mar 16, 2026 |
| Oracle_linux | — | Upgrade ruby-develUpgrade rubygem-test-unitUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-bundlerUpgrade ruby-default-gemsUpgrade rubygem-irbUpgrade rubygem-raccUpgrade rubygem-rssUpgrade rubygem-rexmlUpgrade rubygemsUpgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygem-rbsUpgrade rubygem-psychUpgrade rubygem-typeprofUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade ruby-bundled-gemsUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-pg-doc | Dec 15, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade ruby-docUpgrade rubygem-pgUpgrade rubyUpgrade rubygemsUpgrade rubygem-pg-docUpgrade ruby-default-gemsUpgrade rubygem-rssUpgrade rubygem-jsonUpgrade rubygem-bundlerUpgrade rubygem-pg-debugsourceNo solution existsUpgrade ruby-libs-debuginfoUpgrade ruby-libsUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-irbUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rbsUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade ruby-bundled-gemsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-typeprofUpgrade rubygem-io-consoleUpgrade rubygem-abrt-docUpgrade rubygem-rbs-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygem-rexmlUpgrade rubygem-racc-debuginfoUpgrade rubygem-raccUpgrade ruby-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-pg-debuginfo | Dec 15, 2025 | Sep 17, 2025 |
| Rocky_linux | — | Upgrade ruby-bundled-gemsUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psychUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-raccUpgrade rubygem-rbsUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade ruby-devel | Feb 5, 2026 | Jan 3, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Sep 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub