REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.
CVSS Details
- CVSS 4.0 Base Score: 1.2 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-test-unitUpgrade rubygem-raccUpgrade rubygems-develUpgrade ruby-docUpgrade rubygem-rexmlUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade rubygem-rbsUpgrade rubygem-mysql2-docUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygemsUpgrade rubygem-abrtUpgrade rubyUpgrade ruby-bundled-gemsUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade rubygem-mysql2Upgrade ruby-develUpgrade rubygem-bundlerUpgrade rubygem-rdocUpgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade rubygem-rssUpgrade rubygem-typeprof | Jan 8, 2026 | Dec 10, 2025 |
| Alpine Linux | — | Upgrade ruby-rexml | Jan 7, 2026 | Sep 17, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2Upgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-docUpgrade ruby3.2-default-gemsUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rss | Sep 30, 2025 | Sep 17, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-opensslUpgrade ruby-irbUpgrade rubygemsUpgrade ruby-helpUpgrade rubygem-bigdecimalUpgrade rubygem-did_you_meanUpgrade rubygem-rdocUpgrade rubygem-io-console | Mar 17, 2026 | Mar 16, 2026 |
| Oracle_linux | — | Upgrade rubygem-pg-docUpgrade rubygem-abrtUpgrade rubygemsUpgrade rubygem-psychUpgrade ruby-docUpgrade ruby-libsUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade ruby-bundled-gemsUpgrade rubygem-rssUpgrade rubygem-rexmlUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-rbsUpgrade rubygem-abrt-docUpgrade rubygem-typeprofUpgrade rubygem-mysql2-docUpgrade rubygem-test-unitUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade ruby-develUpgrade rubygem-irbUpgrade ruby-default-gemsUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubygem-rdocUpgrade rubygem-racc | Dec 15, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-rexmlUpgrade rubygem-typeprofUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-rdocUpgrade rubygem-test-unitUpgrade rubygem-racc-debuginfoUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-abrt-docUpgrade rubygem-io-consoleUpgrade ruby-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-raccUpgrade rubygem-mysql2-docUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade rubyUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubygem-irbUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubygem-jsonUpgrade ruby-libsNo solution existsUpgrade rubygem-pg-debugsourceUpgrade rubygem-abrtUpgrade rubygem-power_assertUpgrade rubygem-rssUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-mysql2-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-rbsUpgrade rubygem-minitestUpgrade ruby-docUpgrade ruby-libs-debuginfo | Dec 15, 2025 | Sep 17, 2025 |
| Rocky_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-rbs-debuginfoUpgrade rubygem-psychUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-debuginfoUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade ruby-bundled-gemsUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade rubygem-rbsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pgUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-develUpgrade rubygem-racc-debuginfoUpgrade rubygem-racc | Feb 5, 2026 | Jan 3, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Sep 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub