REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubyUpgrade rubygem-test-unitUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-rexmlUpgrade rubygem-raccUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade rubygem-rbsUpgrade rubygem-rakeUpgrade rubygem-abrtUpgrade rubygem-io-consoleUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-rssUpgrade ruby-bundled-gemsUpgrade rubygem-pgUpgrade rubygem-typeprofUpgrade rubygem-abrt-docUpgrade rubygem-pg-docUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade ruby-libsUpgrade rubygem-power_assertUpgrade ruby-default-gemsUpgrade rubygemsUpgrade rubygems-develUpgrade rubygem-psych | Sep 23, 2024 | Jul 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Jul 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-libsUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-develUpgrade ruby3.2Upgrade ruby3.2-rubygem-json-debuginfo | Apr 2, 2025 | Jul 16, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Jan 20, 2025 | Jul 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Nov 11, 2024 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Dec 12, 2024 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jan 15, 2025 | Jul 16, 2024 |
| Oracle_linux | — | Upgrade rubygem-jsonUpgrade rubygem-irbUpgrade ruby-bundled-gemsUpgrade rubygem-rdocUpgrade ruby-default-gemsUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubygem-rakeUpgrade rubyUpgrade rubygem-rbsUpgrade rubygem-rexmlUpgrade ruby-develUpgrade rubygem-mysql2Upgrade rubygem-raccUpgrade rubygem-psychUpgrade rubygem-typeprofUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-io-consoleUpgrade rubygem-rssUpgrade rubygem-power_assertUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygems-devel | Oct 16, 2024 | Jul 16, 2024 |
| Redhat_linux | — | Upgrade rubygem-irbUpgrade rubygem-minitestUpgrade ruby-default-gemsUpgrade ruby-libsUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygemsUpgrade ruby-debugsourceUpgrade ruby-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade rubygem-psychUpgrade rubygem-pg-docUpgrade rubygem-rbsUpgrade rubyUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-rssUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade ruby-develNo solution existsUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-raccUpgrade rubygem-test-unitUpgrade rubygem-racc-debuginfoUpgrade rubygem-rexmlUpgrade rubygems-develUpgrade rubygem-rbs-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2-docUpgrade rubygem-json-debuginfoUpgrade rubygem-rakeUpgrade rubygem-rdocUpgrade rubygem-abrt-docUpgrade rubygem-io-console-debuginfo | Sep 20, 2024 | Jul 16, 2024 |
| Rocky_linux | — | Upgrade ruby-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rbsUpgrade rubygem-pg-debugsourceUpgrade rubygem-rbs-debuginfoUpgrade rubygem-jsonUpgrade rubygem-pg-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubygem-raccUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubyUpgrade ruby-libs-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pgUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade ruby-develUpgrade rubygem-racc-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-io-console-debuginfo | Oct 2, 2024 | Jul 16, 2024 |
| Suse | — | Upgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade ruby2.5-develUpgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade ruby2.5-rubygem-rexml-docUpgrade libruby2_5-2_5 | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade ruby3.0Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.7Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby3.2Upgrade ruby2.7Upgrade libruby3.2Upgrade libruby3.0Upgrade libruby2.7 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.3Upgrade ruby3.3 | Nov 6, 2024 | Jul 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub