REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bundlerUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-irbUpgrade rubygem-rexmlUpgrade rubygem-raccUpgrade ruby-develUpgrade rubygem-rakeUpgrade pcs-snmpUpgrade rubygem-rssUpgrade rubyUpgrade rubygem-rbsUpgrade ruby-default-gemsUpgrade ruby-libsUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-docUpgrade pcsUpgrade rubygem-bigdecimalUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-typeprofUpgrade rubygem-pgUpgrade rubygem-power_assertUpgrade rubygems | Sep 18, 2024 | Sep 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Aug 1, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-debugsourceUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-develUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2Upgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-bundler | Apr 2, 2025 | Aug 1, 2024 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Jan 20, 2025 | Aug 1, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Nov 11, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Dec 12, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jan 15, 2025 | Aug 1, 2024 |
| Oracle_linux | — | Upgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-abrtUpgrade rubygem-psychUpgrade rubygem-raccUpgrade rubyUpgrade rubygem-rssUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade rubygem-rbsUpgrade pcs-snmpUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade ruby-default-gemsUpgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-typeprofUpgrade pcsUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-rexmlUpgrade ruby-develUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-bigdecimal | Oct 16, 2024 | Aug 1, 2024 |
| Redhat_linux | — | Upgrade rubygem-psychUpgrade ruby-default-gemsUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-rdocUpgrade rubygem-abrt-docUpgrade rubygem-psych-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygemsUpgrade pcsUpgrade rubygem-typeprofUpgrade rubygem-mysql2-docUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygem-bundlerUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debuginfoUpgrade rubyUpgrade rubygem-rbsUpgrade rubygem-raccUpgrade rubygem-irbUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-racc-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2Upgrade pcs-snmpUpgrade rubygem-rssUpgrade ruby-develUpgrade rubygem-rbs-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-rexmlUpgrade rubygem-rakeUpgrade rubygem-pg-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-bundled-gemsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-abrtNo solution exists | Sep 18, 2024 | Aug 1, 2024 |
| Rocky_linux | — | Upgrade rubygem-racc-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-raccUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pgUpgrade rubyUpgrade ruby-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade pcsUpgrade ruby-develUpgrade rubygem-psychUpgrade rubygem-rbsUpgrade ruby-libsUpgrade pcs-snmpUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-jsonUpgrade rubygem-pg-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2Upgrade rubygem-bigdecimal | Sep 17, 2024 | Aug 1, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade ruby2.5-devel | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.3Upgrade ruby3.3Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.7Upgrade libruby3.0Upgrade ruby3.2Upgrade libruby2.7 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby3.0 | Nov 6, 2024 | Aug 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub