REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-did_you_meanUpgrade rubygem-xmlrpcUpgrade rubygem-bsonUpgrade pcs-snmpUpgrade rubygems-develUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-mongo-docUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade rubygem-minitestUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-mysql2-docUpgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubygem-rdocUpgrade rubygem-bundler-docUpgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade rubygem-bson-docUpgrade rubygem-abrt-docUpgrade pcsUpgrade rubygem-mongo | Jul 19, 2024 | May 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-libsUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-docUpgrade ruby3.2-debugsourceUpgrade ruby3.2Upgrade ruby3.2-debuginfo | Apr 2, 2025 | May 16, 2024 |
| Debian | — | Upgrade ruby2.7 | Jan 20, 2025 | May 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | May 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Nov 11, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Oct 9, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Nov 11, 2024 | May 16, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade rubygem-bson-docUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-xmlrpcUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubygem-rdocUpgrade pcsUpgrade rubygem-jsonUpgrade rubygem-test-unitUpgrade rubygem-bundler-docUpgrade rubygem-mongoUpgrade rubygem-bsonUpgrade rubygem-did_you_meanUpgrade rubygem-mongo-docUpgrade rubygems-develUpgrade rubygem-bundlerUpgrade rubygem-io-consoleUpgrade ruby-docUpgrade pcs-snmpUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-rakeUpgrade rubygem-mysql2-doc | Aug 16, 2024 | May 16, 2024 |
| Redhat_linux | — | Upgrade ruby-irbUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-bson-docUpgrade ruby-libsUpgrade rubygem-openssl-debuginfoUpgrade rubygems-develUpgrade rubygem-bson-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-psychUpgrade pcs-snmpUpgrade rubygem-did_you_meanUpgrade rubygem-rakeUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-mongo-docUpgrade ruby-libs-debuginfoUpgrade rubygem-net-telnetUpgrade rubygem-mysql2Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygem-bsonUpgrade rubygem-bundler-docUpgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade rubygem-mongoUpgrade rubyUpgrade rubygem-pg-docUpgrade pcsUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debuginfoNo solution existsUpgrade rubygem-opensslUpgrade rubygem-io-console-debuginfoUpgrade ruby-docUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-json | Jul 16, 2024 | May 16, 2024 |
| Rocky_linux | — | Upgrade ruby-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-psychUpgrade ruby-libs-debuginfoUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade rubygem-bsonUpgrade rubygem-pgUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debuginfoUpgrade rubyUpgrade pcsUpgrade rubygem-jsonUpgrade rubygem-bson-debuginfoUpgrade pcs-snmpUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade rubygem-opensslUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-bson-debugsource | Jul 16, 2024 | May 16, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-develUpgrade ruby2.5-docUpgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-ri | Dec 5, 2025 | Sep 18, 2024 |
| Ubuntu | — | Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.3Upgrade libruby2.7Upgrade ruby3.3Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby2.7Upgrade libruby3.0Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby3.0Upgrade ruby3.2Upgrade ruby2.3 (Ubuntu Pro) | Nov 6, 2024 | May 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub