REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
CVSS Details
- CVSS 4.0 Base Score: 6.6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-test-unitUpgrade rubygem-mysql2Upgrade rubygem-rexmlUpgrade rubygem-pgUpgrade ruby-default-gemsUpgrade rubygem-net-telnetUpgrade rubygemsUpgrade rubygem-rbsUpgrade rubygem-rssUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygem-bsonUpgrade rubygem-typeprofUpgrade rubygem-xmlrpcUpgrade rubygem-opensslUpgrade ruby-bundled-gemsUpgrade rubygem-jsonUpgrade rubygem-bson-docUpgrade ruby-libsUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygem-bundler-docUpgrade pcsUpgrade rubygem-psychUpgrade ruby-docUpgrade ruby-develUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-pg-docUpgrade rubygem-mongo-docUpgrade rubygems-develUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygem-bigdecimalUpgrade rubygem-abrtUpgrade rubygem-rakeUpgrade pcs-snmpUpgrade rubygem-irbUpgrade rubygem-power_assert | Dec 10, 2024 | Oct 28, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Oct 28, 2024 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 4, 2025 | Nov 3, 2025 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Jan 20, 2025 | Oct 28, 2024 |
| Dell Powerstore Dsa2025342 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Oct 28, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Jan 14, 2025 | Oct 28, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Feb 11, 2025 | Oct 28, 2024 |
| Oracle_linux | — | Upgrade rubygem-opensslUpgrade pcsUpgrade rubygem-typeprofUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygems-develUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade ruby-default-gemsUpgrade rubygem-bundler-docUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-mongoUpgrade rubygem-net-telnetUpgrade rubygem-bson-docUpgrade rubygemsUpgrade ruby-libsUpgrade rubygem-rdocUpgrade rubygem-rexmlUpgrade rubygem-bundlerUpgrade rubygem-did_you_meanUpgrade ruby-bundled-gemsUpgrade ruby-irbUpgrade pcs-snmpUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2Upgrade rubygem-rakeUpgrade rubygem-irbUpgrade rubygem-bsonUpgrade rubygem-bigdecimalUpgrade rubygem-xmlrpcUpgrade rubygem-mongo-docUpgrade rubygem-abrtUpgrade rubyUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-test-unit | Dec 6, 2024 | Oct 28, 2024 |
| Redhat_linux | — | Upgrade ruby-debugsourceUpgrade rubygem-bson-docUpgrade pcs-snmpUpgrade rubygem-json-debuginfoUpgrade rubygem-typeprofUpgrade ruby-libsUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bsonUpgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rakeUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-psychNo solution existsUpgrade rubygem-bson-debuginfoUpgrade rubygems-develUpgrade rubygem-did_you_meanUpgrade rubygem-pg-debuginfoUpgrade rubygem-mongo-docUpgrade rubygem-abrt-docUpgrade rubygem-rexmlUpgrade rubygem-openssl-debuginfoUpgrade rubygem-rssUpgrade ruby-debuginfoUpgrade rubygem-bson-debugsourceUpgrade rubygem-rbsUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-minitestUpgrade rubygem-opensslUpgrade ruby-docUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade ruby-develUpgrade rubygem-pg-docUpgrade rubygem-io-console-debuginfoUpgrade rubyUpgrade pcsUpgrade rubygem-net-telnetUpgrade rubygem-rdocUpgrade rubygem-pgUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-mongoUpgrade rubygem-mysql2Upgrade ruby-libs-debuginfoUpgrade rubygem-abrtUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bundler-docUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-power_assert | Feb 10, 2025 | Oct 28, 2024 |
| Rocky_linux | — | Upgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubyUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-opensslUpgrade rubygem-rbsUpgrade pcsUpgrade rubygem-pgUpgrade rubygem-openssl-debuginfoUpgrade ruby-debugsourceUpgrade pcs-snmpUpgrade rubygem-bsonUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubygem-pg-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-jsonUpgrade rubygem-io-console | Feb 5, 2026 | Jul 29, 2025 |
| Ubuntu | — | Upgrade ruby3.3Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.3Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby3.2Upgrade ruby2.7Upgrade libruby3.2Upgrade libruby3.0Upgrade ruby3.0Upgrade ruby2.3 (Ubuntu Pro) | Nov 6, 2024 | Oct 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub