REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.
CVSS Details
- CVSS 4.0 Base Score: 1.2 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-psychUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-raccUpgrade ruby-libsUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade rubygem-mysql2Upgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubygem-bundlerUpgrade rubygem-power_assertUpgrade ruby-default-gemsUpgrade rubygem-minitestUpgrade rubygem-irbUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-rdocUpgrade rubygem-typeprofUpgrade rubygem-jsonUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade rubygemsUpgrade rubyUpgrade ruby-bundled-gems | Jan 8, 2026 | Dec 10, 2025 |
| Alpine Linux | — | Upgrade ruby-rexml | Jan 7, 2026 | Sep 17, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-default-gemsUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2Upgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-doc | Sep 30, 2025 | Sep 17, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade rubygemsUpgrade rubygem-jsonUpgrade rubyUpgrade ruby-irbUpgrade rubygem-psychUpgrade rubygem-openssl | Mar 17, 2026 | Mar 16, 2026 |
| Oracle_linux | — | Upgrade rubygem-test-unitUpgrade rubygem-irbUpgrade ruby-default-gemsUpgrade rubygem-rakeUpgrade rubygem-pgUpgrade rubygem-power_assertUpgrade rubygem-rdocUpgrade rubygem-raccUpgrade rubygem-mysql2-docUpgrade rubygem-bundlerUpgrade rubygems-develUpgrade rubygem-minitestUpgrade ruby-develUpgrade rubygem-mysql2Upgrade rubygem-pg-docUpgrade rubygem-psychUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygem-typeprofUpgrade rubygem-rbsUpgrade rubygem-bigdecimalUpgrade ruby-bundled-gemsUpgrade rubygem-abrtUpgrade ruby-libsUpgrade rubygemsUpgrade rubygem-rssUpgrade rubygem-rexmlUpgrade ruby-docUpgrade rubyUpgrade rubygem-json | Dec 15, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-io-consoleUpgrade rubygem-mysql2-docUpgrade rubygem-test-unitUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pg-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-raccUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rexmlUpgrade rubygem-bigdecimalUpgrade rubygem-typeprofUpgrade rubygem-psych-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-rakeUpgrade rubygems-develUpgrade ruby-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade ruby-bundled-gemsUpgrade rubygemsNo solution existsUpgrade ruby-docUpgrade ruby-libs-debuginfoUpgrade rubygem-rbsUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade rubyUpgrade ruby-develUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-rssUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-abrt | Dec 15, 2025 | Sep 17, 2025 |
| Rocky_linux | — | Upgrade rubyUpgrade rubygem-mysql2Upgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rbsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-raccUpgrade ruby-develUpgrade ruby-libs-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pgUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-rbs-debuginfoUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade ruby-bundled-gemsUpgrade ruby-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsource | Feb 5, 2026 | Jan 3, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Sep 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub