REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-psychUpgrade rubygems-develUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-minitestUpgrade rubygem-abrt-docUpgrade rubygem-typeprofUpgrade ruby-libsUpgrade ruby-default-gemsUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-mysql2-docUpgrade rubygem-irbUpgrade rubygem-io-consoleUpgrade rubygem-test-unitUpgrade ruby-bundled-gemsUpgrade rubygem-rbsUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubyUpgrade rubygem-rakeUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-raccUpgrade rubygem-rexmlUpgrade rubygem-bundlerUpgrade rubygem-rss | Sep 23, 2024 | Jul 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Jul 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2Upgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-debugsourceUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-default-gemsUpgrade ruby3.2-bundled-gems-debuginfo | Apr 2, 2025 | Jul 16, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Jan 20, 2025 | Jul 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Nov 11, 2024 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Dec 12, 2024 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Jan 15, 2025 | Jul 16, 2024 |
| Oracle_linux | — | Upgrade rubygem-pgUpgrade rubygem-test-unitUpgrade rubygem-typeprofUpgrade rubygem-minitestUpgrade rubygem-rssUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-rbsUpgrade rubygem-pg-docUpgrade ruby-docUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygem-raccUpgrade rubygem-mysql2-docUpgrade ruby-bundled-gemsUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade rubygem-rexmlUpgrade ruby-develUpgrade rubygem-mysql2Upgrade rubygem-irbUpgrade ruby-default-gems | Oct 16, 2024 | Jul 16, 2024 |
| Redhat_linux | — | Upgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade ruby-debugsourceUpgrade rubygem-pg-debugsourceUpgrade ruby-libsUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-minitestUpgrade ruby-default-gemsNo solution existsUpgrade rubygem-irbUpgrade rubygem-jsonUpgrade rubygemsUpgrade rubyUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debuginfoUpgrade ruby-develUpgrade ruby-bundled-gemsUpgrade ruby-docUpgrade rubygem-pgUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade rubygem-power_assertUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygem-psych-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-racc-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-abrt-docUpgrade rubygem-rakeUpgrade rubygem-rbs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-raccUpgrade ruby-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-rexml | Sep 20, 2024 | Jul 16, 2024 |
| Rocky_linux | — | Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-pgUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-debuginfoUpgrade ruby-develUpgrade ruby-libs-debuginfoUpgrade rubyUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade rubygem-raccUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rbsUpgrade rubygem-mysql2Upgrade rubygem-rbs-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debugsource | Oct 2, 2024 | Jul 16, 2024 |
| Suse | — | Upgrade ruby2.5Upgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-docUpgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-stdlibUpgrade ruby2.5-develUpgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-ri | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.7Upgrade libruby3.2Upgrade ruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby3.0Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby2.7Upgrade libruby3.3Upgrade ruby3.3Upgrade libruby3.0Upgrade libruby2.7 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro) | Nov 6, 2024 | Jul 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub