The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2Upgrade ruby-bundled-gemsUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade rubygem-abrtUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-io-consoleUpgrade rubygem-rbsUpgrade rubygem-rexmlUpgrade rubygem-rakeUpgrade rubygem-raccUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade rubygem-rssUpgrade rubygem-typeprofUpgrade rubygemsUpgrade ruby-libsUpgrade ruby-default-gemsUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade rubygems-develUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-pgUpgrade rubygem-minitest | Sep 23, 2024 | Jul 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Jul 16, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-libsUpgrade ruby3.2-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-develUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2 | Apr 2, 2025 | Jul 16, 2024 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Jan 20, 2025 | Jul 16, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Nov 11, 2024 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Dec 12, 2024 | Jul 16, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jan 15, 2025 | Jul 16, 2024 |
| Oracle_linux | — | Upgrade rubygem-pg-docUpgrade rubyUpgrade ruby-default-gemsUpgrade rubygem-rdocUpgrade rubygem-rbsUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2-docUpgrade rubygem-bundlerUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-rexmlUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade rubygem-mysql2Upgrade rubygem-raccUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygemsUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-rssUpgrade rubygem-typeprofUpgrade rubygem-abrt-doc | Oct 16, 2024 | Jul 16, 2024 |
| Redhat_linux | — | Upgrade ruby-libs-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-bundled-gemsUpgrade rubyUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psychUpgrade ruby-develUpgrade ruby-docUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade rubygem-power_assertUpgrade ruby-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsNo solution existsUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade rubygem-minitestUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-irbUpgrade ruby-default-gemsUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-racc-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-typeprofUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-test-unitUpgrade rubygem-abrt-docUpgrade rubygem-rakeUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-rbs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rexmlUpgrade rubygem-raccUpgrade ruby-debuginfo | Sep 20, 2024 | Jul 16, 2024 |
| Rocky_linux | — | Upgrade ruby-bundled-gemsUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-psychUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-consoleUpgrade ruby-debugsourceUpgrade rubygem-raccUpgrade rubygem-mysql2Upgrade rubygem-rbsUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubyUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-racc-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pgUpgrade ruby-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psych-debuginfo | Oct 2, 2024 | Jul 16, 2024 |
| Suse | — | Upgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade ruby2.5-develUpgrade ruby2.5Upgrade ruby2.5-rubygem-rexml-docUpgrade libruby2_5-2_5 | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade libruby2.7Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.0Upgrade ruby2.7Upgrade libruby3.2Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby3.2Upgrade ruby3.3Upgrade libruby3.0Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.3Upgrade libruby2.7 (Ubuntu Pro) | Nov 6, 2024 | Jul 16, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub