REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade pcs-snmpUpgrade ruby-docUpgrade rubygem-xmlrpcUpgrade rubygem-mongo-docUpgrade rubygem-bundlerUpgrade ruby-irbUpgrade rubygem-rakeUpgrade ruby-libsUpgrade rubygem-test-unitUpgrade ruby-develUpgrade rubygem-bsonUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-mongoUpgrade rubygem-bundler-docUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2Upgrade rubygem-rdocUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade pcsUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade rubygem-bson-doc | Jul 19, 2024 | May 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2Upgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-minitest | Apr 2, 2025 | May 16, 2024 |
| Debian | — | Upgrade ruby2.7 | Jan 20, 2025 | May 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | May 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Nov 11, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Oct 9, 2024 | May 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Nov 11, 2024 | May 16, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 8, 2024 |
| Oracle_linux | — | Upgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade rubygem-mongo-docUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-did_you_meanUpgrade rubygem-bundlerUpgrade pcs-snmpUpgrade rubygem-pg-docUpgrade rubyUpgrade rubygem-rdocUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-opensslUpgrade ruby-libsUpgrade rubygem-test-unitUpgrade rubygem-jsonUpgrade pcsUpgrade rubygem-bsonUpgrade rubygem-bson-docUpgrade rubygem-mongoUpgrade rubygem-bundler-docUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade rubygem-xmlrpcUpgrade rubygemsUpgrade rubygem-net-telnetUpgrade rubygem-psych | Aug 16, 2024 | May 16, 2024 |
| Redhat_linux | — | Upgrade rubygem-bundler-docUpgrade ruby-docUpgrade rubygem-minitestUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade rubygem-net-telnetUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubygem-rdocUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-mongoUpgrade rubygem-pgUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-power_assertNo solution existsUpgrade rubygem-jsonUpgrade ruby-libs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade pcsUpgrade rubygem-bson-debugsourceUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-bson-docUpgrade pcs-snmpUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade ruby-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-xmlrpcUpgrade rubygem-did_you_meanUpgrade rubygem-json-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade rubygems-devel | Jul 16, 2024 | May 16, 2024 |
| Rocky_linux | — | Upgrade pcs-snmpUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debuginfoUpgrade ruby-develUpgrade rubygem-bson-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-opensslUpgrade rubygem-bson-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-libsUpgrade rubyUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2Upgrade ruby-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bsonUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade pcsUpgrade rubygem-jsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pgUpgrade ruby-debuginfo | Jul 16, 2024 | May 16, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-devel-extraUpgrade libruby2_5-2_5Upgrade ruby2.5Upgrade ruby2.5-develUpgrade ruby2.5-stdlibUpgrade ruby2.5-docUpgrade ruby2.5-doc-riUpgrade ruby2.5-rubygem-rexml | Dec 5, 2025 | Sep 18, 2024 |
| Ubuntu | — | Upgrade libruby2.7 (Ubuntu Pro)Upgrade libruby3.2Upgrade libruby3.0Upgrade ruby2.7Upgrade ruby3.0Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby3.2Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby3.3Upgrade libruby2.7Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby3.3 | Nov 6, 2024 | May 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub