REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-raccUpgrade rubygem-abrtUpgrade rubygem-rssUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade ruby-default-gemsUpgrade rubyUpgrade ruby-docUpgrade pcs-snmpUpgrade rubygem-bundlerUpgrade rubygem-rakeUpgrade ruby-bundled-gemsUpgrade rubygem-rexmlUpgrade rubygem-jsonUpgrade rubygem-irbUpgrade rubygem-rbsUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-pg-docUpgrade pcsUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade rubygem-typeprofUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygem-rdoc | Sep 18, 2024 | Sep 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Aug 1, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-develUpgrade ruby3.2Upgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-debugsourceUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-doc | Apr 2, 2025 | Aug 1, 2024 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Jan 20, 2025 | Aug 1, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Nov 11, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Dec 12, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jan 15, 2025 | Aug 1, 2024 |
| Oracle_linux | — | Upgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade pcsUpgrade rubygem-typeprofUpgrade rubygemsUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-bigdecimalUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade ruby-docUpgrade rubygem-power_assertUpgrade rubygem-io-consoleUpgrade ruby-default-gemsUpgrade rubygem-minitestUpgrade rubygem-raccUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade rubyUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygem-pg-docUpgrade pcs-snmp | Oct 16, 2024 | Aug 1, 2024 |
| Redhat_linux | — | Upgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade rubyUpgrade ruby-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-rbsUpgrade rubygem-io-consoleNo solution existsUpgrade ruby-docUpgrade rubygem-irbUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby-bundled-gemsUpgrade rubygem-racc-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-rexmlUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rakeUpgrade rubygem-raccUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade pcs-snmpUpgrade rubygem-rbs-debuginfoUpgrade rubygem-rssUpgrade rubygemsUpgrade ruby-debugsourceUpgrade rubygem-mysql2-docUpgrade rubygem-psych-debuginfoUpgrade pcsUpgrade rubygem-psychUpgrade ruby-libsUpgrade ruby-default-gemsUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade ruby-libs-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-typeprofUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rdocUpgrade rubygem-abrt-doc | Sep 18, 2024 | Aug 1, 2024 |
| Rocky_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-pgUpgrade ruby-develUpgrade rubygem-raccUpgrade rubyUpgrade ruby-libs-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade pcsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-jsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade pcs-snmpUpgrade rubygem-rbs-debuginfoUpgrade ruby-libsUpgrade ruby-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-rbsUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2 | Sep 17, 2024 | Aug 1, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-stdlibUpgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5Upgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade ruby2.5-devel | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby3.2Upgrade libruby3.0Upgrade libruby3.2Upgrade ruby3.0Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.7Upgrade libruby2.7Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.3Upgrade ruby3.3 | Nov 6, 2024 | Aug 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub