REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-pg-docUpgrade rubygem-raccUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade pcs-snmpUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-rakeUpgrade rubygem-rdocUpgrade rubygem-typeprofUpgrade ruby-develUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-abrt-docUpgrade rubygem-rssUpgrade rubygemsUpgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade ruby-default-gemsUpgrade rubygem-bundlerUpgrade rubygem-pgUpgrade rubygem-irbUpgrade rubygem-jsonUpgrade rubyUpgrade ruby-docUpgrade rubygem-mysql2Upgrade rubygem-rbsUpgrade rubygem-psychUpgrade ruby-bundled-gemsUpgrade pcs | Sep 18, 2024 | Sep 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Aug 1, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-develUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygemsUpgrade ruby3.2-docUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-debugsourceUpgrade ruby3.2Upgrade ruby3.2-libsUpgrade ruby3.2-default-gems | Apr 2, 2025 | Aug 1, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Jan 20, 2025 | Aug 1, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Nov 11, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Dec 12, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Jan 15, 2025 | Aug 1, 2024 |
| Oracle_linux | — | Upgrade rubygemsUpgrade ruby-default-gemsUpgrade rubygem-test-unitUpgrade pcsUpgrade rubygem-irbUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubygem-rbsUpgrade rubygem-rdocUpgrade rubygem-power_assertUpgrade rubyUpgrade rubygem-mysql2-docUpgrade rubygem-typeprofUpgrade rubygem-minitestUpgrade ruby-develUpgrade rubygem-abrtUpgrade pcs-snmpUpgrade rubygem-jsonUpgrade rubygem-rexmlUpgrade rubygem-abrt-docUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade ruby-bundled-gemsUpgrade rubygem-raccUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade ruby-libsUpgrade ruby-docUpgrade rubygem-mysql2Upgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-rss | Oct 16, 2024 | Aug 1, 2024 |
| Redhat_linux | — | Upgrade rubygem-json-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-rexmlUpgrade rubygem-rbs-debuginfoUpgrade rubygems-develUpgrade rubygem-rakeUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-racc-debuginfoUpgrade pcs-snmpUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-pg-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-test-unitUpgrade rubygem-psych-debuginfoUpgrade rubygem-pgUpgrade rubygem-irbUpgrade rubygem-pg-docUpgrade ruby-default-gemsUpgrade rubygem-rdocUpgrade rubygem-mysql2-debuginfoUpgrade pcsNo solution existsUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-abrtUpgrade rubyUpgrade rubygemsUpgrade rubygem-raccUpgrade rubygem-power_assertUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade rubygem-io-console-debuginfoUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade ruby-bundled-gemsUpgrade ruby-devel | Sep 18, 2024 | Aug 1, 2024 |
| Rocky_linux | — | Upgrade rubygem-jsonUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade rubygem-rbsUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade pcsUpgrade rubygem-psych-debuginfoUpgrade rubygem-psychUpgrade rubyUpgrade ruby-bundled-gemsUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade pcs-snmpUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-racc-debuginfoUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-racc | Sep 17, 2024 | Aug 1, 2024 |
| Suse | — | Upgrade ruby2.5Upgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-docUpgrade ruby2.5-doc-riUpgrade ruby2.5-develUpgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-stdlibUpgrade ruby2.5-rubygem-rexml-doc | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade libruby2.7Upgrade ruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby2.7Upgrade ruby3.3Upgrade libruby3.3Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.7 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby3.0 | Nov 6, 2024 | Aug 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub