REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-rakeUpgrade rubygem-irbUpgrade ruby-docUpgrade rubygem-mysql2-docUpgrade rubygem-io-consoleUpgrade ruby-bundled-gemsUpgrade rubygem-rssUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-rbsUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-test-unitUpgrade rubygem-raccUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygem-rexmlUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-typeprofUpgrade rubygem-minitestUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade ruby-libs | Sep 23, 2024 | Jul 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Jul 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-libsUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2Upgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-json | Apr 2, 2025 | Jul 16, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Jan 20, 2025 | Jul 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Nov 11, 2024 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Dec 12, 2024 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jan 15, 2025 | Jul 16, 2024 |
| Oracle_linux | — | Upgrade rubygem-psychUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-rssUpgrade rubygem-typeprofUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygem-test-unitUpgrade rubygemsUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygem-raccUpgrade rubyUpgrade rubygem-mysql2-docUpgrade rubygem-bundlerUpgrade rubygem-rakeUpgrade rubygem-mysql2Upgrade ruby-develUpgrade rubygem-abrtUpgrade rubygem-irbUpgrade rubygem-rbsUpgrade rubygem-pg-docUpgrade ruby-docUpgrade rubygem-rdocUpgrade ruby-bundled-gemsUpgrade ruby-default-gemsUpgrade rubygem-jsonUpgrade rubygem-rexml | Oct 16, 2024 | Jul 16, 2024 |
| Redhat_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-rexmlUpgrade rubygem-typeprofUpgrade rubygem-io-console-debuginfoUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-raccUpgrade rubygem-racc-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-rdocUpgrade rubygem-test-unitUpgrade rubygem-psych-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-json-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-bundlerUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-mysql2-debuginfoUpgrade rubyUpgrade rubygem-irbNo solution existsUpgrade rubygem-jsonUpgrade rubygemsUpgrade ruby-docUpgrade rubygem-rbsUpgrade rubygem-pgUpgrade rubygem-psychUpgrade ruby-libs-debuginfoUpgrade rubygem-minitestUpgrade ruby-default-gemsUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-rssUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-bundled-gemsUpgrade ruby-debugsourceUpgrade rubygem-abrt | Sep 20, 2024 | Jul 16, 2024 |
| Rocky_linux | — | Upgrade rubygem-racc-debuginfoUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade rubyUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pgUpgrade rubygem-raccUpgrade ruby-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-jsonUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-rbsUpgrade rubygem-io-consoleUpgrade ruby-bundled-gemsUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-psych | Oct 2, 2024 | Jul 16, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5Upgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5-develUpgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.5-devel-extra | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.0Upgrade ruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.7Upgrade libruby2.7Upgrade libruby2.7 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby3.3Upgrade libruby3.3Upgrade libruby2.3 (Ubuntu Pro) | Nov 6, 2024 | Jul 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub