REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mongoUpgrade rubygem-mysql2-docUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-bundler-docUpgrade rubygem-opensslUpgrade pcsUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubyUpgrade rubygem-net-telnetUpgrade rubygem-abrt-docUpgrade rubygem-pg-docUpgrade rubygem-rdocUpgrade rubygem-abrtUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade rubygem-bsonUpgrade rubygem-xmlrpcUpgrade rubygem-did_you_meanUpgrade pcs-snmpUpgrade ruby-docUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade ruby-irbUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-test-unitUpgrade rubygem-mongo-docUpgrade rubygem-bundler | Jul 19, 2024 | May 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-debuginfoUpgrade ruby3.2Upgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-docUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-typeprof | Apr 2, 2025 | May 16, 2024 |
| Debian | — | Upgrade ruby2.7 | Jan 20, 2025 | May 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | May 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Nov 11, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Oct 9, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Nov 11, 2024 | May 16, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-net-telnetUpgrade rubyUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygem-xmlrpcUpgrade ruby-libsUpgrade rubygemsUpgrade rubygem-opensslUpgrade rubygem-abrtUpgrade rubygem-mongoUpgrade rubygem-bson-docUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade pcsUpgrade rubygem-bundler-docUpgrade rubygem-test-unitUpgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-bundlerUpgrade pcs-snmpUpgrade ruby-docUpgrade ruby-irbUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygem-power_assertUpgrade rubygem-mongo-docUpgrade rubygem-minitest | Aug 16, 2024 | May 16, 2024 |
| Redhat_linux | — | Upgrade rubygem-rakeUpgrade pcs-snmpUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade rubygem-did_you_meanUpgrade ruby-libsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade rubygem-xmlrpcUpgrade ruby-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygem-json-debuginfoUpgrade rubygem-mongo-docUpgrade ruby-debugsourceUpgrade rubygem-bson-docUpgrade rubygems-develUpgrade ruby-irbUpgrade rubygem-psych-debuginfoUpgrade pcsUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docNo solution existsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-net-telnetUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygemsUpgrade rubygem-rdocUpgrade ruby-develUpgrade rubygem-abrtUpgrade rubygem-jsonUpgrade rubygem-pg-debugsourceUpgrade rubygem-power_assertUpgrade ruby-docUpgrade rubygem-bsonUpgrade rubygem-bundler-doc | Jul 16, 2024 | May 16, 2024 |
| Rocky_linux | — | Upgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade rubyUpgrade ruby-libsUpgrade pcsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psychUpgrade ruby-libs-debuginfoUpgrade rubygem-bsonUpgrade rubygem-openssl-debuginfoUpgrade rubygem-pgUpgrade rubygem-pg-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade pcs-snmpUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-bson-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-openssl | Jul 16, 2024 | May 16, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-docUpgrade ruby2.5Upgrade ruby2.5-develUpgrade libruby2_5-2_5Upgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-doc-riUpgrade ruby2.5-stdlibUpgrade ruby2.5-devel-extra | Dec 5, 2025 | Sep 18, 2024 |
| Ubuntu | — | Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby3.2Upgrade ruby3.0Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.2Upgrade libruby3.0Upgrade ruby2.7Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.3Upgrade ruby3.3Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.7 | Nov 6, 2024 | May 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub