REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-psychUpgrade rubygem-irbUpgrade rubygemsUpgrade rubygem-abrt-docUpgrade rubygem-abrtUpgrade rubygem-jsonUpgrade rubygem-bundlerUpgrade rubygem-rssUpgrade ruby-bundled-gemsUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-test-unitUpgrade pcsUpgrade ruby-default-gemsUpgrade rubyUpgrade rubygem-rexmlUpgrade rubygem-rbsUpgrade ruby-docUpgrade rubygem-pgUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygem-typeprofUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-minitestUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade rubygem-pg-docUpgrade rubygem-raccUpgrade rubygem-power_assertUpgrade pcs-snmp | Sep 18, 2024 | Sep 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Aug 1, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-develUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-libsUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygemsUpgrade ruby3.2-debugsourceUpgrade ruby3.2Upgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-irb | Apr 2, 2025 | Aug 1, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Jan 20, 2025 | Aug 1, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Nov 11, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Dec 12, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jan 15, 2025 | Aug 1, 2024 |
| Oracle_linux | — | Upgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-rbsUpgrade rubygem-test-unitUpgrade rubygem-abrtUpgrade ruby-develUpgrade rubygem-irbUpgrade pcsUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubygem-power_assertUpgrade rubygem-typeprofUpgrade rubygem-rdocUpgrade rubyUpgrade rubygem-mysql2-docUpgrade rubygem-jsonUpgrade rubygem-abrt-docUpgrade rubygem-rexmlUpgrade rubygem-psychUpgrade rubygem-raccUpgrade ruby-libsUpgrade ruby-docUpgrade ruby-bundled-gemsUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2Upgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade pcs-snmpUpgrade rubygem-rss | Oct 16, 2024 | Aug 1, 2024 |
| Redhat_linux | — | Upgrade ruby-libsUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade rubygem-racc-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-pg-debuginfoUpgrade rubygem-rakeUpgrade pcs-snmpUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-mysql2-debugsourceUpgrade rubygems-develUpgrade ruby-debugsourceUpgrade ruby-default-gemsUpgrade rubygem-rbsUpgrade rubygem-jsonUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygemsUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade rubygem-raccUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-bundled-gemsUpgrade ruby-docUpgrade rubygem-rssUpgrade rubygem-power_assertUpgrade ruby-libs-debuginfoNo solution existsUpgrade rubygem-rdocUpgrade rubygem-mysql2-debuginfoUpgrade pcsUpgrade rubygem-abrtUpgrade rubyUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade rubygem-mysql2-doc | Sep 18, 2024 | Aug 1, 2024 |
| Rocky_linux | — | Upgrade ruby-debuginfoUpgrade ruby-libsUpgrade ruby-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-racc-debuginfoUpgrade pcs-snmpUpgrade rubygem-io-consoleUpgrade rubygem-raccUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-jsonUpgrade rubygem-psych-debuginfoUpgrade rubygem-pgUpgrade rubygem-psychUpgrade rubygem-rbsUpgrade rubygem-io-console-debuginfoUpgrade pcsUpgrade rubygem-pg-debugsourceUpgrade ruby-libs-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade rubyUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2 | Sep 17, 2024 | Aug 1, 2024 |
| Suse | — | Upgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-docUpgrade ruby2.5Upgrade ruby2.5-stdlibUpgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-develUpgrade ruby2.5-doc-riUpgrade ruby2.5-rubygem-rexml-doc | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade ruby3.3Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby3.0Upgrade libruby3.0Upgrade ruby2.7Upgrade libruby3.3Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby3.2Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.7 | Nov 6, 2024 | Aug 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub