REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-pg-docUpgrade rubyUpgrade rubygem-bson-docUpgrade pcsUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade rubygem-abrt-docUpgrade rubygem-opensslUpgrade rubygem-power_assertUpgrade rubygem-net-telnetUpgrade rubygem-bundler-docUpgrade rubygem-mysql2Upgrade rubygem-mysql2-docUpgrade rubygem-psychUpgrade rubygem-mongoUpgrade rubygem-pgUpgrade ruby-libsUpgrade rubygem-xmlrpcUpgrade rubygem-test-unitUpgrade rubygem-mongo-docUpgrade rubygem-bundlerUpgrade rubygem-did_you_meanUpgrade ruby-develUpgrade rubygem-bsonUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade pcs-snmpUpgrade ruby-docUpgrade ruby-irbUpgrade rubygems-develUpgrade rubygem-rake | Jul 19, 2024 | May 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2Upgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-default-gems | Apr 2, 2025 | May 16, 2024 |
| Debian | — | Upgrade ruby2.7 | Jan 20, 2025 | May 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | May 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Nov 11, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Oct 9, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Nov 11, 2024 | May 16, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-mongoUpgrade rubygem-rdocUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygemsUpgrade rubygem-bson-docUpgrade rubygem-test-unitUpgrade ruby-libsUpgrade rubygem-xmlrpcUpgrade rubygem-bundler-docUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade rubyUpgrade pcsUpgrade rubygem-pgUpgrade rubygem-jsonUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade pcs-snmpUpgrade ruby-docUpgrade rubygem-bundlerUpgrade rubygem-did_you_meanUpgrade ruby-irbUpgrade rubygem-pg-docUpgrade rubygem-bigdecimalUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-mongo-docUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade rubygem-io-console | Aug 16, 2024 | May 16, 2024 |
| Redhat_linux | — | Upgrade rubygem-bsonNo solution existsUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade pcsUpgrade rubygem-pgUpgrade rubygem-power_assertUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-minitestUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-bundler-docUpgrade rubygem-pg-docUpgrade ruby-docUpgrade rubygem-rdocUpgrade rubygem-psych-debuginfoUpgrade rubygem-opensslUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade rubygem-mongoUpgrade rubygem-abrtUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-psychUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade pcs-snmpUpgrade rubygem-pg-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-xmlrpcUpgrade ruby-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bson-docUpgrade ruby-libsUpgrade ruby-debuginfoUpgrade ruby-irbUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-abrt-docUpgrade rubygem-test-unitUpgrade rubygem-bigdecimal | Jul 16, 2024 | May 16, 2024 |
| Rocky_linux | — | Upgrade pcsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubyUpgrade ruby-libs-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade rubygem-pgUpgrade rubygem-bsonUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade pcs-snmpUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-opensslUpgrade rubygem-mysql2-debuginfo | Jul 16, 2024 | May 16, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rexmlUpgrade libruby2_5-2_5Upgrade ruby2.5Upgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-doc-riUpgrade ruby2.5-stdlibUpgrade ruby2.5-docUpgrade ruby2.5-devel-extraUpgrade ruby2.5-devel | Dec 5, 2025 | Sep 18, 2024 |
| Ubuntu | — | Upgrade ruby3.3Upgrade libruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby3.3Upgrade libruby2.7 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.7Upgrade libruby3.2Upgrade ruby3.2Upgrade ruby3.0Upgrade libruby3.0Upgrade ruby2.3 (Ubuntu Pro) | Nov 6, 2024 | May 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub