REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ruby-libsUpgrade rubygem-rexmlUpgrade rubygem-bundlerUpgrade rubygem-rbsUpgrade rubygem-rssUpgrade ruby-default-gemsUpgrade rubygem-mysql2Upgrade rubygem-abrtUpgrade rubygemsUpgrade ruby-bundled-gemsUpgrade pcsUpgrade rubyUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygem-irbUpgrade rubygem-jsonUpgrade rubygem-abrt-docUpgrade rubygem-test-unitUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-rakeUpgrade rubygem-raccUpgrade pcs-snmpUpgrade rubygem-mysql2-docUpgrade rubygem-rdocUpgrade rubygem-typeprofUpgrade rubygem-power_assertUpgrade ruby-develUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-bigdecimal | Sep 18, 2024 | Sep 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Aug 1, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2Upgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-develUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-rss | Apr 2, 2025 | Aug 1, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Jan 20, 2025 | Aug 1, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Nov 11, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Dec 12, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jan 15, 2025 | Aug 1, 2024 |
| Oracle_linux | — | Upgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-raccUpgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubygem-pgUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygem-typeprofUpgrade rubygem-power_assertUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade rubygem-irbUpgrade pcsUpgrade ruby-develUpgrade rubygem-abrtUpgrade ruby-default-gemsUpgrade rubygemsUpgrade rubygem-rbsUpgrade rubygem-minitestUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-rssUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygem-rakeUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade pcs-snmpUpgrade rubygem-rexml | Oct 16, 2024 | Aug 1, 2024 |
| Redhat_linux | — | Upgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-psych-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-mysql2-docUpgrade rubygem-pgUpgrade rubygem-io-console-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-power_assertUpgrade rubygem-pg-debugsourceUpgrade rubygem-abrtUpgrade rubyUpgrade rubygem-minitestNo solution existsUpgrade pcsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rdocUpgrade ruby-libs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygemsUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade ruby-develUpgrade ruby-docUpgrade rubygem-rbsUpgrade rubygem-jsonUpgrade rubygem-rssUpgrade rubygem-raccUpgrade rubygem-json-debuginfoUpgrade ruby-libsUpgrade ruby-debugsourceUpgrade rubygem-rexmlUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-racc-debuginfoUpgrade rubygem-rakeUpgrade pcs-snmpUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade rubygem-rbs-debuginfoUpgrade rubygems-develUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-test-unit | Sep 18, 2024 | Aug 1, 2024 |
| Rocky_linux | — | Upgrade rubygem-bigdecimal-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-develUpgrade rubygem-psych-debuginfoUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-pgUpgrade rubygem-rbsUpgrade rubygem-pg-debugsourceUpgrade pcsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-racc-debuginfoUpgrade ruby-debugsourceUpgrade pcs-snmpUpgrade rubygem-raccUpgrade ruby-libsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade ruby-debuginfo | Sep 17, 2024 | Aug 1, 2024 |
| Suse | — | Upgrade libruby2_5-2_5Upgrade ruby2.5Upgrade ruby2.5-docUpgrade ruby2.5-devel-extraUpgrade ruby2.5-stdlibUpgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-doc-riUpgrade ruby2.5-develUpgrade ruby2.5-rubygem-rexml-doc | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade ruby3.2Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.2Upgrade libruby2.7Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.0Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby3.0Upgrade ruby2.7Upgrade ruby3.3Upgrade libruby3.3Upgrade libruby2.7 (Ubuntu Pro) | Nov 6, 2024 | Aug 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub