REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygems-develUpgrade ruby-default-gemsUpgrade rubygemsUpgrade rubygem-abrt-docUpgrade rubygem-typeprofUpgrade rubygem-minitestUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade rubygem-power_assertUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade ruby-bundled-gemsUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubyUpgrade rubygem-test-unitUpgrade rubygem-abrtUpgrade rubygem-rexmlUpgrade rubygem-rbsUpgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade rubygem-bigdecimalUpgrade rubygem-irbUpgrade rubygem-raccUpgrade ruby-develUpgrade rubygem-rssUpgrade rubygem-rakeUpgrade rubygem-mysql2 | Sep 23, 2024 | Jul 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Jul 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2Upgrade ruby3.2-develUpgrade ruby3.2-debuginfo | Apr 2, 2025 | Jul 16, 2024 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Jan 20, 2025 | Jul 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Nov 11, 2024 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Dec 12, 2024 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jan 15, 2025 | Jul 16, 2024 |
| Oracle_linux | — | Upgrade rubygem-rexmlUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade rubygem-raccUpgrade ruby-default-gemsUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-irbUpgrade ruby-bundled-gemsUpgrade rubygem-rbsUpgrade ruby-docUpgrade rubygem-mysql2Upgrade rubygem-rdocUpgrade ruby-develUpgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade rubygem-rssUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygems-develUpgrade rubygem-psychUpgrade rubygem-power_assertUpgrade rubygem-abrt-docUpgrade ruby-libsUpgrade rubygem-typeprofUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-bigdecimal | Oct 16, 2024 | Jul 16, 2024 |
| Redhat_linux | — | Upgrade rubygemsUpgrade ruby-develUpgrade rubygem-rbsUpgrade rubygem-pg-debuginfoNo solution existsUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade ruby-bundled-gemsUpgrade rubygem-irbUpgrade ruby-docUpgrade ruby-libsUpgrade rubygem-rssUpgrade rubygem-bundlerUpgrade rubygem-pgUpgrade rubygem-mysql2-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-pg-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debugsourceUpgrade rubyUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-abrtUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade rubygem-rbs-debuginfoUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade rubygem-io-consoleUpgrade rubygem-raccUpgrade rubygem-abrt-docUpgrade rubygem-json-debuginfoUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygem-psych-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-typeprofUpgrade rubygem-mysql2-docUpgrade rubygem-io-console-debuginfoUpgrade rubygem-racc-debuginfo | Sep 20, 2024 | Jul 16, 2024 |
| Rocky_linux | — | Upgrade rubygem-racc-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubyUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rbsUpgrade rubygem-mysql2Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade ruby-bundled-gemsUpgrade rubygem-raccUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libsUpgrade rubygem-pg-debuginfo | Oct 2, 2024 | Jul 16, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade libruby2_5-2_5Upgrade ruby2.5-develUpgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-ri | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade libruby3.3Upgrade ruby3.3Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.0Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby2.7Upgrade libruby3.2Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.2Upgrade ruby3.0Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.7Upgrade ruby2.3 (Ubuntu Pro) | Nov 6, 2024 | Jul 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub