REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-xmlrpcUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-bsonUpgrade rubygem-did_you_meanUpgrade rubygem-rakeUpgrade rubygem-bundlerUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-test-unitUpgrade ruby-irbUpgrade rubygems-develUpgrade pcs-snmpUpgrade ruby-develUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade pcsUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygem-jsonUpgrade rubygemsUpgrade rubygem-bson-docUpgrade rubygem-minitestUpgrade rubygem-net-telnetUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade rubygem-bundler-docUpgrade rubygem-mysql2-docUpgrade rubygem-mongoUpgrade rubygem-power_assertUpgrade rubygem-abrtUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade ruby | Jul 19, 2024 | May 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygemsUpgrade ruby3.2-docUpgrade ruby3.2-libsUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2Upgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-bundler | Apr 2, 2025 | May 16, 2024 |
| Debian | — | Upgrade ruby2.7 | Jan 20, 2025 | May 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | May 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Nov 11, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Oct 9, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Nov 11, 2024 | May 16, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-power_assertUpgrade rubygem-bundlerUpgrade rubygem-did_you_meanUpgrade pcs-snmpUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-docUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-minitestUpgrade rubygem-mongo-docUpgrade rubygem-pg-docUpgrade rubygem-bigdecimalUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade pcsUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade ruby-libsUpgrade rubygem-rdocUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-abrt-docUpgrade rubygem-net-telnetUpgrade rubygem-mongoUpgrade rubygem-bsonUpgrade rubygem-bson-docUpgrade rubygem-bundler-docUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygem-json | Aug 16, 2024 | May 16, 2024 |
| Redhat_linux | — | Upgrade rubygem-pg-debuginfoUpgrade pcs-snmpUpgrade rubygem-did_you_meanUpgrade rubygem-rakeUpgrade rubygem-json-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-mongo-docUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade ruby-irbUpgrade rubygem-openssl-debuginfoUpgrade ruby-debuginfoUpgrade rubygems-develUpgrade rubygem-jsonUpgrade rubygem-pgUpgrade rubygem-mongoUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade rubygem-bundler-docUpgrade ruby-docUpgrade rubygem-bsonUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-io-console-debuginfoNo solution existsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pg-docUpgrade pcsUpgrade rubygem-bundlerUpgrade rubygem-psych-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-mysql2-doc | Jul 16, 2024 | May 16, 2024 |
| Rocky_linux | — | Upgrade ruby-libs-debuginfoUpgrade rubygem-bsonUpgrade ruby-debugsourceUpgrade rubygem-jsonUpgrade rubygem-mysql2-debugsourceUpgrade pcsUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubyUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-pgUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psychUpgrade rubygem-bson-debuginfoUpgrade pcs-snmpUpgrade rubygem-opensslUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bson-debugsourceUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfo | Jul 16, 2024 | May 16, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-docUpgrade ruby2.5Upgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.5-devel-extraUpgrade ruby2.5-develUpgrade libruby2_5-2_5 | Dec 5, 2025 | Sep 18, 2024 |
| Ubuntu | — | Upgrade libruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.3Upgrade ruby3.3Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby2.7Upgrade ruby3.0Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.2Upgrade libruby2.7 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby3.2 | Nov 6, 2024 | May 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub