REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
CVSS Details
- CVSS 4.0 Base Score: 6.6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade rubygem-did_you_meanUpgrade pcs-snmpUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-abrtUpgrade ruby-irbUpgrade rubygem-power_assertUpgrade rubygem-mongo-docUpgrade rubygem-bundler-docUpgrade rubygem-mongoUpgrade rubygem-rssUpgrade rubygem-minitestUpgrade rubygem-net-telnetUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2Upgrade rubygem-opensslUpgrade ruby-libsUpgrade pcsUpgrade rubygem-psychUpgrade rubygem-mysql2-docUpgrade rubygem-typeprofUpgrade rubygemsUpgrade rubygem-xmlrpcUpgrade rubygem-bsonUpgrade rubygem-rdocUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade rubygem-rexmlUpgrade rubygem-rbsUpgrade rubygem-test-unitUpgrade rubygem-bson-docUpgrade rubygem-jsonUpgrade rubygem-abrt-doc | Dec 10, 2024 | Oct 28, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Oct 28, 2024 |
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Nov 4, 2025 | Nov 4, 2025 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Jan 20, 2025 | Oct 28, 2024 |
| Dell Powerstore Dsa2025342 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 2, 2025 |
| Dell Powerstore Dsa2026039 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Jan 6, 2026 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Oct 28, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Jan 14, 2025 | Oct 28, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Feb 11, 2025 | Oct 28, 2024 |
| Oracle_linux | — | Upgrade ruby-default-gemsUpgrade rubygem-pg-docUpgrade rubygem-bundler-docUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-mongoUpgrade rubygem-opensslUpgrade rubygem-power_assertUpgrade rubygem-bson-docUpgrade rubygemsUpgrade ruby-libsUpgrade rubygem-rdocUpgrade rubygems-develUpgrade pcsUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade rubygem-bsonUpgrade ruby-develUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-test-unitUpgrade rubygem-jsonUpgrade ruby-docUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-did_you_meanUpgrade rubygem-mongo-docUpgrade rubygem-abrtUpgrade rubygem-xmlrpcUpgrade rubygem-rexmlUpgrade ruby-bundled-gemsUpgrade pcs-snmpUpgrade ruby-irbUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-net-telnet | Dec 6, 2024 | Oct 28, 2024 |
| Redhat_linux | — | Upgrade ruby-irbUpgrade rubygem-bson-docNo solution existsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-mongo-docUpgrade ruby-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-rexmlUpgrade rubygem-bson-debugsourceUpgrade ruby-debugsourceUpgrade rubygem-did_you_meanUpgrade rubygem-abrt-docUpgrade rubygem-openssl-debuginfoUpgrade pcs-snmpUpgrade rubygem-rbs-debuginfoUpgrade rubygem-typeprofUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-jsonUpgrade rubygem-rssUpgrade ruby-bundled-gemsUpgrade rubygem-bsonUpgrade rubygems-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-bson-debuginfoUpgrade rubygem-pg-docUpgrade rubygemsUpgrade rubygem-opensslUpgrade ruby-libs-debuginfoUpgrade rubygem-rbsUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-minitestUpgrade ruby-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-xmlrpcUpgrade ruby-default-gemsUpgrade rubygem-mongoUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-docUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-test-unitUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-net-telnetUpgrade rubygem-rdocUpgrade pcsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bundler-docUpgrade rubygem-abrt | Feb 10, 2025 | Oct 28, 2024 |
| Rocky_linux | — | Upgrade rubygem-io-console-debuginfoUpgrade rubygem-pgUpgrade ruby-develUpgrade rubygem-rbsUpgrade ruby-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-opensslUpgrade rubyUpgrade pcsUpgrade ruby-libs-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade pcs-snmpUpgrade rubygem-bigdecimalUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygem-bson-debugsourceUpgrade rubygem-bson-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-json-debuginfoUpgrade ruby-bundled-gemsUpgrade ruby-debugsourceUpgrade rubygem-openssl-debuginfoUpgrade rubygem-bsonUpgrade ruby-libsUpgrade rubygem-rbs-debuginfoUpgrade rubygem-psych | Feb 5, 2026 | Jul 29, 2025 |
| Ubuntu | — | Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby2.7Upgrade ruby3.3Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.3Upgrade libruby3.2Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby3.0Upgrade ruby3.2Upgrade ruby2.7Upgrade libruby3.0 | Nov 6, 2024 | Oct 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub