REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-minitestUpgrade pcsUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade rubygem-rdocUpgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade rubygem-bundler-docUpgrade rubygem-bson-docUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygem-bsonUpgrade rubygem-rakeUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-bundlerUpgrade ruby-irbUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade rubygem-did_you_meanUpgrade rubygem-test-unitUpgrade pcs-snmpUpgrade rubygems-devel | Jul 19, 2024 | May 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-libsUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2Upgrade ruby3.2-develUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-io-console | Apr 2, 2025 | May 16, 2024 |
| Debian | — | Upgrade ruby2.7 | Jan 20, 2025 | May 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | May 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Nov 11, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Oct 9, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Nov 11, 2024 | May 16, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-rdocUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygem-mongoUpgrade rubygem-bsonUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade rubygem-abrtUpgrade rubygem-bson-docUpgrade rubygem-bundler-docUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-net-telnetUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-test-unitUpgrade pcsUpgrade rubygem-jsonUpgrade rubygems-develUpgrade rubygem-rakeUpgrade ruby-docUpgrade pcs-snmpUpgrade rubygem-did_you_meanUpgrade rubygem-minitestUpgrade rubygem-mongo-docUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-pg-docUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade rubygem-power_assertUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-doc | Aug 16, 2024 | May 16, 2024 |
| Redhat_linux | — | Upgrade rubygem-bundler-docUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade ruby-libs-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-docUpgrade ruby-docUpgrade rubyUpgrade rubygem-rdocUpgrade rubygem-abrtUpgrade rubygem-mongoUpgrade rubygem-opensslUpgrade rubygem-mysql2Upgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygemsUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade rubygem-jsonUpgrade rubygem-bundlerUpgrade rubygem-bsonNo solution existsUpgrade rubygem-net-telnetUpgrade pcsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade ruby-libsUpgrade rubygem-bson-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-debuginfoUpgrade rubygem-bson-docUpgrade rubygem-openssl-debuginfoUpgrade ruby-irbUpgrade rubygems-develUpgrade rubygem-mongo-docUpgrade rubygem-psychUpgrade rubygem-xmlrpcUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rakeUpgrade rubygem-did_you_meanUpgrade rubygem-pg-debuginfoUpgrade pcs-snmp | Jul 16, 2024 | May 16, 2024 |
| Rocky_linux | — | Upgrade pcsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-pgUpgrade rubyUpgrade ruby-debuginfoUpgrade ruby-libsUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-openssl-debuginfoUpgrade ruby-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade pcs-snmpUpgrade rubygem-json-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-opensslUpgrade rubygem-bigdecimalUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-console | Jul 16, 2024 | May 16, 2024 |
| Suse | — | Upgrade ruby2.5-stdlibUpgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5Upgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade ruby2.5-develUpgrade ruby2.5-rubygem-rexml | Dec 5, 2025 | Sep 18, 2024 |
| Ubuntu | — | Upgrade libruby3.3Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.3Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.7Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby3.0Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.7Upgrade libruby3.0 | Nov 6, 2024 | May 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub