REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-test-unitUpgrade rubygem-rexmlUpgrade ruby-libsUpgrade rubyUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade pcs-snmpUpgrade rubygem-rbsUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade ruby-develUpgrade ruby-bundled-gemsUpgrade rubygem-abrtUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-rssUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-raccUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygem-typeprofUpgrade rubygem-pg-docUpgrade ruby-default-gemsUpgrade rubygems-develUpgrade rubygem-minitestUpgrade pcsUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade rubygem-pg | Sep 18, 2024 | Sep 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Aug 22, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rssUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygemsUpgrade ruby3.2Upgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-typeprof | Apr 2, 2025 | Aug 22, 2024 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 4, 2025 | Nov 3, 2025 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Jan 20, 2025 | Aug 22, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Aug 22, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Nov 11, 2024 | Aug 22, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Dec 12, 2024 | Aug 22, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jan 15, 2025 | Aug 22, 2024 |
| Oracle_linux | — | Upgrade ruby-develUpgrade rubygem-pg-docUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-power_assertUpgrade pcs-snmpUpgrade rubygem-typeprofUpgrade rubygem-raccUpgrade rubygem-minitestUpgrade ruby-default-gemsUpgrade rubygems-develUpgrade rubygem-rdocUpgrade ruby-libsUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2Upgrade rubygem-rexmlUpgrade rubygem-abrtUpgrade rubygem-rssUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-rbsUpgrade rubygemsUpgrade ruby-bundled-gemsUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-irbUpgrade pcs | Oct 16, 2024 | Aug 22, 2024 |
| Redhat_linux | — | Upgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade ruby-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-rbsUpgrade rubyUpgrade rubygem-rakeUpgrade ruby-libsUpgrade rubygem-rbs-debuginfoUpgrade rubygem-irbUpgrade ruby-bundled-gemsUpgrade ruby-docUpgrade ruby-default-gemsUpgrade rubygem-rexmlNo solution existsUpgrade ruby-debuginfoUpgrade rubygem-abrtUpgrade rubygem-racc-debuginfoUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-test-unitUpgrade ruby-develUpgrade rubygem-rssUpgrade rubygem-typeprofUpgrade rubygem-pg-debuginfoUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygemsUpgrade rubygem-bigdecimal-debuginfoUpgrade pcsUpgrade rubygem-io-console-debuginfoUpgrade pcs-snmpUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-raccUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-json-debuginfo | Sep 18, 2024 | Aug 22, 2024 |
| Rocky_linux | — | Upgrade rubygem-json-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade pcsUpgrade ruby-libs-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade ruby-debuginfoUpgrade ruby-bundled-gemsUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-develUpgrade rubygem-io-console-debuginfoUpgrade rubygem-raccUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rbsUpgrade pcs-snmpUpgrade rubygem-racc-debuginfoUpgrade rubygem-jsonUpgrade rubygem-mysql2 | Sep 17, 2024 | Aug 22, 2024 |
| Suse | — | Upgrade ruby2.5-rubygem-rexmlUpgrade ruby2.5-doc-riUpgrade ruby2.5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-stdlibUpgrade ruby2.5-rubygem-rexml-docUpgrade ruby2.5-develUpgrade libruby2_5-2_5Upgrade ruby2.5-doc | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | — | Upgrade ruby3.2Upgrade libruby2.7Upgrade libruby3.2Upgrade ruby3.3Upgrade ruby2.7Upgrade libruby3.0Upgrade libruby3.3Upgrade ruby3.0 | Feb 7, 2025 | Aug 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub