REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-rakeUpgrade rubygem-raccUpgrade ruby-default-gemsUpgrade rubygem-abrtUpgrade ruby-docUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-bundlerUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-irbUpgrade rubyUpgrade ruby-develUpgrade rubygem-rexmlUpgrade ruby-libsUpgrade rubygem-rssUpgrade pcs-snmpUpgrade rubygem-rbsUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-test-unitUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade pcsUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygems | Sep 18, 2024 | Sep 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Aug 1, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2Upgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-develUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-debugsourceUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-libsUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rss | Apr 2, 2025 | Aug 1, 2024 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Jan 20, 2025 | Aug 1, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Nov 11, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Dec 12, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Jan 15, 2025 | Aug 1, 2024 |
| Oracle_linux | — | Upgrade rubygem-raccUpgrade rubygem-rbsUpgrade rubygem-jsonUpgrade rubygem-irbUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-abrt-docUpgrade rubygem-rakeUpgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-minitestUpgrade ruby-default-gemsUpgrade ruby-docUpgrade rubygem-rssUpgrade rubygem-power_assertUpgrade pcs-snmpUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygem-test-unitUpgrade rubygem-rexmlUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-bigdecimalUpgrade ruby-develUpgrade rubygem-rdocUpgrade pcsUpgrade rubygem-mysql2-docUpgrade rubygem-typeprofUpgrade rubygems-devel | Oct 16, 2024 | Aug 1, 2024 |
| Redhat_linux | — | Upgrade pcsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade rubygemsUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade ruby-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-typeprofUpgrade rubygem-minitestUpgrade ruby-default-gemsUpgrade ruby-libsUpgrade rubygem-rssUpgrade rubyUpgrade ruby-bundled-gemsUpgrade rubygem-rbs-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debugsourceUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade rubygem-irbUpgrade rubygem-test-unitUpgrade rubygem-pg-debuginfoUpgrade rubygem-rbsUpgrade rubygem-mysql2Upgrade pcs-snmpUpgrade rubygem-raccUpgrade rubygem-rexmlUpgrade rubygem-pg-debugsourceNo solution existsUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rake | Sep 18, 2024 | Aug 1, 2024 |
| Rocky_linux | — | Upgrade rubygem-json-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pg-debuginfoUpgrade pcs-snmpUpgrade rubygem-bigdecimalUpgrade rubygem-rbsUpgrade ruby-bundled-gemsUpgrade ruby-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-jsonUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade pcsUpgrade rubygem-racc-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-raccUpgrade rubygem-pgUpgrade rubyUpgrade ruby-libs-debuginfo | Sep 17, 2024 | Aug 1, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-stdlibUpgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5Upgrade ruby2.5-develUpgrade ruby2.5-devel-extraUpgrade ruby2.5-docUpgrade ruby2.5-doc-riUpgrade libruby2_5-2_5 | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade ruby3.3Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby3.3Upgrade ruby2.7Upgrade libruby2.7Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby3.2Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby3.0Upgrade libruby3.0Upgrade libruby2.7 (Ubuntu Pro) | Nov 6, 2024 | Aug 1, 2024 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub