REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
CVSS Details
- CVSS 4.0 Base Score: 6.6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bson-docUpgrade rubygem-mysql2-docUpgrade ruby-default-gemsUpgrade rubygem-typeprofUpgrade rubygem-xmlrpcUpgrade rubygem-bsonUpgrade rubygem-rbsUpgrade rubygem-abrt-docUpgrade rubygem-rexmlUpgrade rubygem-mongoUpgrade rubygem-rssUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-minitestUpgrade rubygem-net-telnetUpgrade rubygem-psychUpgrade rubygem-rdocUpgrade pcsUpgrade rubygem-opensslUpgrade rubygem-mysql2Upgrade rubygem-test-unitUpgrade ruby-libsUpgrade rubygem-bundler-docUpgrade rubygem-bundlerUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade ruby-develUpgrade rubygem-did_you_meanUpgrade rubygem-abrtUpgrade rubygems-develUpgrade rubyUpgrade rubygem-pg-docUpgrade rubygem-irbUpgrade pcs-snmpUpgrade rubygem-power_assertUpgrade ruby-docUpgrade rubygem-mongo-docUpgrade rubygem-rake | Dec 10, 2024 | Oct 28, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Oct 28, 2024 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 4, 2025 | Nov 4, 2025 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Jan 20, 2025 | Oct 28, 2024 |
| Dell Powerstore Dsa2025342 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Oct 28, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Jan 14, 2025 | Oct 28, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Feb 11, 2025 | Oct 28, 2024 |
| Oracle_linux | — | Upgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade ruby-default-gemsUpgrade rubygem-bundler-docUpgrade ruby-libsUpgrade rubygem-rdocUpgrade rubygem-abrt-docUpgrade rubygemsUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygem-mongoUpgrade pcsUpgrade rubygem-typeprofUpgrade rubygem-bson-docUpgrade rubygem-power_assertUpgrade rubygem-psychUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade ruby-develUpgrade rubygem-rexmlUpgrade ruby-bundled-gemsUpgrade pcs-snmpUpgrade rubygem-rbsUpgrade rubygem-mysql2-docUpgrade rubygem-rssUpgrade ruby-irbUpgrade rubygem-test-unitUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade ruby-docUpgrade rubygem-irbUpgrade rubygem-bsonUpgrade rubygem-bigdecimalUpgrade rubygem-did_you_meanUpgrade rubygem-bundlerUpgrade rubygem-rakeUpgrade rubyUpgrade rubygem-abrtUpgrade rubygem-mongo-docUpgrade rubygem-xmlrpc | Dec 6, 2024 | Oct 28, 2024 |
| Redhat_linux | — | Upgrade rubygem-bundler-docUpgrade rubygem-bundlerUpgrade pcsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rdocUpgrade rubygem-net-telnetUpgrade ruby-libs-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade rubygem-mongoUpgrade ruby-bundled-gems-debuginfoUpgrade rubyUpgrade rubygem-rbsUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade rubygem-io-console-debuginfoUpgrade rubygem-xmlrpcUpgrade ruby-docUpgrade rubygem-minitestUpgrade rubygem-pg-debugsourceUpgrade rubygemsUpgrade rubygem-opensslUpgrade rubygem-pg-docUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubygem-bsonUpgrade pcs-snmpUpgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-rssUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-rexmlUpgrade rubygem-mongo-docUpgrade ruby-debugsourceUpgrade rubygem-json-debuginfoUpgrade ruby-libsUpgrade rubygem-openssl-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-abrt-docNo solution existsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bson-docUpgrade rubygems-develUpgrade rubygem-typeprofUpgrade rubygem-bson-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-debuginfo | Feb 10, 2025 | Oct 28, 2024 |
| Rocky_linux | — | Upgrade rubygem-pg-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-rbs-debuginfoUpgrade rubygem-openssl-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade pcs-snmpUpgrade rubygem-bsonUpgrade rubygem-json-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-opensslUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-psych-debuginfoUpgrade rubygem-rbsUpgrade rubygem-pgUpgrade rubygem-io-console-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubyUpgrade pcsUpgrade rubygem-pg-debugsourceUpgrade ruby-debuginfo | Feb 5, 2026 | Jul 29, 2025 |
| Ubuntu | — | Upgrade ruby3.0Upgrade libruby3.0Upgrade libruby3.2Upgrade ruby3.2Upgrade ruby2.7Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby3.3Upgrade libruby3.3Upgrade ruby2.5 (Ubuntu Pro) | Nov 6, 2024 | Oct 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub