REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygems-develUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-rdocUpgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade rubygem-bigdecimalUpgrade rubygem-typeprofUpgrade rubygem-raccUpgrade pcs-snmpUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubyUpgrade rubygem-rbsUpgrade rubygem-pgUpgrade rubygemsUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-rexmlUpgrade rubygem-psychUpgrade ruby-bundled-gemsUpgrade rubygem-test-unitUpgrade rubygem-abrtUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-rssUpgrade rubygem-abrt-docUpgrade rubygem-irbUpgrade ruby-default-gemsUpgrade pcs | Sep 18, 2024 | Sep 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Aug 1, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-libsUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2Upgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygemsUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-rbs-debuginfo | Apr 2, 2025 | Aug 1, 2024 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Jan 20, 2025 | Aug 1, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Nov 11, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Dec 12, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Jan 15, 2025 | Aug 1, 2024 |
| Oracle_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade ruby-bundled-gemsUpgrade ruby-libsUpgrade rubygem-rssUpgrade pcs-snmpUpgrade rubygem-io-consoleUpgrade rubygem-raccUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-rexmlUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade ruby-default-gemsUpgrade rubygem-bundlerUpgrade rubygem-rdocUpgrade rubygem-typeprofUpgrade rubygem-minitestUpgrade rubygem-rbsUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubyUpgrade ruby-develUpgrade rubygem-abrtUpgrade rubygem-test-unitUpgrade pcsUpgrade rubygem-irb | Oct 16, 2024 | Aug 1, 2024 |
| Redhat_linux | — | Upgrade ruby-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-power_assertUpgrade rubygem-jsonUpgrade rubygem-rbsUpgrade rubygem-abrtUpgrade ruby-bundled-gemsUpgrade rubygem-minitestUpgrade rubygem-mysql2Upgrade rubygem-rssUpgrade rubygem-raccUpgrade rubygem-pgUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-pg-docUpgrade rubyUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade pcsUpgrade rubygem-rdocUpgrade ruby-default-gemsNo solution existsUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-develUpgrade rubygem-irbUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-bundlerUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-rexmlUpgrade rubygem-json-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debugsourceUpgrade rubygems-develUpgrade ruby-debuginfoUpgrade pcs-snmpUpgrade rubygem-rakeUpgrade rubygem-racc-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-io-consoleUpgrade rubygem-typeprofUpgrade rubygem-rbs-debuginfoUpgrade ruby-libs | Sep 18, 2024 | Aug 1, 2024 |
| Rocky_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rbs-debuginfoUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-pg-debuginfoUpgrade rubygem-raccUpgrade pcs-snmpUpgrade rubygem-bigdecimalUpgrade rubygem-racc-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade rubygem-rbsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-develUpgrade rubygem-psychUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pgUpgrade rubygem-jsonUpgrade rubygem-mysql2-debuginfoUpgrade ruby-bundled-gemsUpgrade rubyUpgrade rubygem-mysql2Upgrade pcsUpgrade rubygem-pg-debugsource | Sep 17, 2024 | Aug 1, 2024 |
| Suse | — | Upgrade ruby2.5-develUpgrade ruby2.5-stdlibUpgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-doc-riUpgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5-devel-extraUpgrade ruby2.5 | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade ruby3.0Upgrade libruby3.0Upgrade ruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.3Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby3.3Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.7Upgrade ruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby3.2 | Nov 6, 2024 | Aug 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub