REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-pgUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-irbUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade rubygem-mysql2Upgrade rubygemsUpgrade ruby-default-gemsUpgrade rubygem-abrt-docUpgrade ruby-bundled-gemsUpgrade ruby-docUpgrade pcsUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade pcs-snmpUpgrade rubygem-typeprofUpgrade rubygem-rdocUpgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade rubygem-racc | Sep 18, 2024 | Sep 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Aug 1, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-default-gemsUpgrade ruby3.2-libsUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2Upgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rdoc | Apr 2, 2025 | Aug 1, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Jan 20, 2025 | Aug 1, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Nov 11, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Dec 12, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jan 15, 2025 | Aug 1, 2024 |
| Oracle_linux | — | Upgrade ruby-bundled-gemsUpgrade ruby-docUpgrade pcs-snmpUpgrade rubygem-raccUpgrade rubygem-io-consoleUpgrade rubygem-rssUpgrade rubygem-minitestUpgrade ruby-default-gemsUpgrade rubygem-abrtUpgrade ruby-develUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-power_assertUpgrade pcsUpgrade rubygem-irbUpgrade rubygem-typeprofUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade rubygem-rbsUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-rakeUpgrade rubygem-rexmlUpgrade rubygem-jsonUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade ruby-libs | Oct 16, 2024 | Aug 1, 2024 |
| Redhat_linux | — | Upgrade ruby-default-gemsUpgrade ruby-develUpgrade rubygem-pg-docUpgrade rubygem-jsonUpgrade ruby-libs-debuginfoUpgrade rubygem-rdocUpgrade rubyUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-io-console-debuginfoUpgrade pcsNo solution existsUpgrade rubygem-rssUpgrade rubygem-bundlerUpgrade rubygemsUpgrade rubygem-irbUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rbsUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-raccUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-mysql2-docUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-typeprofUpgrade pcs-snmpUpgrade ruby-debugsourceUpgrade rubygem-rexmlUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-racc-debuginfoUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rakeUpgrade ruby-libs | Sep 18, 2024 | Aug 1, 2024 |
| Rocky_linux | — | Upgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-raccUpgrade pcs-snmpUpgrade ruby-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade pcsUpgrade ruby-bundled-gemsUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-rbsUpgrade rubygem-pg-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2Upgrade rubyUpgrade rubygem-mysql2-debuginfo | Sep 17, 2024 | Aug 1, 2024 |
| Suse | — | Upgrade ruby2.5-devel-extraUpgrade ruby2.5Upgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-develUpgrade ruby2.5-doc-riUpgrade ruby2.5-rubygem-rexml | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade ruby3.3Upgrade libruby3.3Upgrade libruby2.7 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby3.0Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.7Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.7Upgrade libruby3.2Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby3.2Upgrade libruby2.5 (Ubuntu Pro) | Nov 6, 2024 | Aug 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub