REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
CVSS Details
- CVSS 4.0 Base Score: 6.6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-pg-docUpgrade rubygem-bundlerUpgrade rubyUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-mongo-docUpgrade ruby-develUpgrade rubygems-develUpgrade pcs-snmpUpgrade rubygem-abrtUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygem-power_assertUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade rubygem-rexmlUpgrade rubygem-opensslUpgrade rubygem-bsonUpgrade rubygem-mysql2Upgrade rubygem-xmlrpcUpgrade rubygem-net-telnetUpgrade rubygem-minitestUpgrade rubygem-test-unitUpgrade rubygem-bundler-docUpgrade rubygem-rdocUpgrade rubygem-rbsUpgrade rubygemsUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade rubygem-rssUpgrade rubygem-jsonUpgrade pcsUpgrade rubygem-bson-docUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade ruby-default-gemsUpgrade rubygem-mongoUpgrade rubygem-psychUpgrade ruby-bundled-gemsUpgrade rubygem-typeprof | Dec 10, 2024 | Oct 28, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Oct 28, 2024 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 4, 2025 | Nov 4, 2025 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Jan 20, 2025 | Oct 28, 2024 |
| Dell Powerstore Dsa2025342 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Oct 28, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jan 14, 2025 | Oct 28, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Feb 11, 2025 | Oct 28, 2024 |
| Oracle_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-rbsUpgrade rubygem-rexmlUpgrade rubyUpgrade rubygem-mongo-docUpgrade ruby-docUpgrade ruby-irbUpgrade pcs-snmpUpgrade rubygem-xmlrpcUpgrade ruby-develUpgrade ruby-bundled-gemsUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade rubygem-did_you_meanUpgrade rubygem-mysql2Upgrade rubygem-rssUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-irbUpgrade rubygem-test-unitUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-bsonUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade ruby-libsUpgrade rubygem-bundler-docUpgrade ruby-default-gemsUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-typeprofUpgrade pcsUpgrade rubygem-net-telnetUpgrade rubygem-mongoUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade rubygem-bson-docUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-pgUpgrade rubygem-openssl | Dec 6, 2024 | Oct 28, 2024 |
| Redhat_linux | — | Upgrade rubygem-bundlerUpgrade rubygem-mysql2-docUpgrade rubygem-irbUpgrade pcsUpgrade rubygem-net-telnetUpgrade rubyUpgrade rubygem-rdocUpgrade rubygem-test-unitUpgrade ruby-libs-debuginfoUpgrade rubygem-mongoUpgrade ruby-develUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade rubygem-bundler-docUpgrade ruby-default-gemsUpgrade rubygem-psych-debuginfoUpgrade rubygem-abrtUpgrade rubygem-rbsUpgrade rubygem-pg-docUpgrade rubygemsUpgrade rubygem-minitestUpgrade ruby-docUpgrade rubygem-opensslUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-xmlrpcUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-json-debuginfoUpgrade ruby-libsUpgrade rubygem-pg-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-did_you_meanUpgrade rubygem-bson-debuginfoUpgrade ruby-irbUpgrade rubygem-bson-debugsourceUpgrade pcs-snmpUpgrade rubygem-bsonUpgrade rubygem-rakeUpgrade rubygem-typeprofUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rssUpgrade rubygem-jsonUpgrade rubygem-io-consoleNo solution existsUpgrade rubygem-rexmlUpgrade rubygem-mongo-docUpgrade ruby-bundled-gemsUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-bson-docUpgrade rubygems-develUpgrade rubygem-rbs-debuginfoUpgrade rubygem-abrt-doc | Feb 10, 2025 | Oct 28, 2024 |
| Rocky_linux | — | Upgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade pcsUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-pgUpgrade rubygem-io-console-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-rbsUpgrade ruby-bundled-gemsUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-rbs-debuginfoUpgrade pcs-snmpUpgrade rubygem-io-consoleUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-bsonUpgrade rubygem-psychUpgrade rubygem-openssl-debuginfoUpgrade ruby-libsUpgrade ruby-debugsource | Feb 5, 2026 | Jul 29, 2025 |
| Ubuntu | — | Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.7Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.3Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.3Upgrade ruby2.7Upgrade ruby3.2Upgrade libruby3.2Upgrade ruby3.0Upgrade libruby3.0Upgrade ruby2.3 (Ubuntu Pro) | Nov 6, 2024 | Oct 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub