REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygemsUpgrade rubygem-abrt-docUpgrade ruby-libsUpgrade rubygem-typeprofUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-pgUpgrade ruby-default-gemsUpgrade rubygems-develUpgrade rubygem-rssUpgrade rubygem-rakeUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-mysql2-docUpgrade ruby-bundled-gemsUpgrade rubygem-raccUpgrade rubygem-abrtUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-test-unitUpgrade rubygem-rbsUpgrade rubygem-rexmlUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-irb | Sep 23, 2024 | Jul 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Jul 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-develUpgrade ruby3.2Upgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-io-console-debuginfo | Apr 2, 2025 | Jul 16, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Jan 20, 2025 | Jul 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Nov 11, 2024 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Dec 12, 2024 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jan 15, 2025 | Jul 16, 2024 |
| Oracle_linux | — | Upgrade rubygem-rssUpgrade rubygem-power_assertUpgrade rubygem-test-unitUpgrade rubygemsUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-typeprofUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade ruby-bundled-gemsUpgrade rubygem-bigdecimalUpgrade rubygem-irbUpgrade rubygem-rbsUpgrade rubygem-pg-docUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-rdocUpgrade ruby-develUpgrade rubygem-mysql2Upgrade rubygem-rexmlUpgrade rubygem-rakeUpgrade rubygem-raccUpgrade rubygem-jsonUpgrade ruby-default-gemsUpgrade ruby | Oct 16, 2024 | Jul 16, 2024 |
| Redhat_linux | — | Upgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-racc-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-rexmlUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade rubygem-rbs-debuginfoUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-json-debuginfoUpgrade rubygem-raccUpgrade rubyUpgrade ruby-bundled-gemsUpgrade rubygem-pg-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygem-rbsUpgrade rubygem-power_assertUpgrade rubygem-jsonUpgrade rubygem-rssUpgrade rubygem-psychUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoNo solution existsUpgrade rubygem-mysql2Upgrade rubygemsUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade ruby-default-gemsUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-abrtUpgrade ruby-develUpgrade rubygem-bigdecimal-debuginfo | Sep 20, 2024 | Jul 16, 2024 |
| Rocky_linux | — | Upgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubyUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pgUpgrade rubygem-psych-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-rbsUpgrade rubygem-io-consoleUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-raccUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2-debugsource | Oct 2, 2024 | Jul 16, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rexml-docUpgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5Upgrade ruby2.5-develUpgrade ruby2.5-docUpgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-ri | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.2Upgrade libruby2.7Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby3.0Upgrade ruby2.7Upgrade libruby3.0Upgrade ruby3.3Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.3Upgrade libruby2.7 (Ubuntu Pro) | Nov 6, 2024 | Jul 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub