REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-irbUpgrade pcsUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygemsUpgrade rubygem-abrtUpgrade rubygem-pgUpgrade rubygem-rbsUpgrade rubygem-test-unitUpgrade ruby-libsUpgrade rubygem-rexmlUpgrade rubygem-bundlerUpgrade rubygem-mysql2Upgrade rubyUpgrade rubygem-rssUpgrade ruby-default-gemsUpgrade ruby-bundled-gemsUpgrade rubygem-abrt-docUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-minitestUpgrade rubygem-raccUpgrade rubygem-mysql2-docUpgrade rubygem-io-consoleUpgrade rubygem-rdocUpgrade pcs-snmpUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-typeprof | Sep 18, 2024 | Sep 16, 2024 |
| Alpine Linux | — | Upgrade ruby-rexml | Aug 8, 2025 | Aug 1, 2024 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2Upgrade ruby3.2-docUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-debugsourceUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-rss | Apr 2, 2025 | Aug 1, 2024 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Jan 20, 2025 | Aug 1, 2024 |
| Gentoo Linux | — | Upgrade dev-ruby/rexml. | Jul 9, 2025 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Nov 11, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Dec 12, 2024 | Aug 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Jan 15, 2025 | Aug 1, 2024 |
| Oracle_linux | — | Upgrade rubygem-raccUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-rssUpgrade rubygem-rakeUpgrade rubygem-jsonUpgrade pcs-snmpUpgrade rubygem-abrt-docUpgrade ruby-docUpgrade rubygem-psychUpgrade ruby-libsUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2Upgrade rubygem-rexmlUpgrade rubygem-abrtUpgrade ruby-develUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-rbsUpgrade rubygem-minitestUpgrade rubygem-mysql2-docUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubygem-power_assertUpgrade rubyUpgrade ruby-default-gemsUpgrade pcsUpgrade rubygem-typeprof | Oct 16, 2024 | Aug 1, 2024 |
| Redhat_linux | — | Upgrade rubygem-rakeUpgrade pcs-snmpUpgrade rubygem-typeprofUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-rexmlUpgrade rubygem-io-consoleUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade rubygem-json-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-pg-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygems-develUpgrade rubygem-rssUpgrade rubygem-raccUpgrade rubygem-minitestUpgrade ruby-bundled-gemsUpgrade ruby-develUpgrade rubygem-psych-debuginfoUpgrade rubyUpgrade rubygem-abrtUpgrade rubygem-power_assertUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rbsUpgrade ruby-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-bundlerUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rdocUpgrade pcsUpgrade ruby-libs-debuginfoNo solution existsUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2Upgrade ruby-default-gemsUpgrade rubygem-mysql2-docUpgrade rubygem-pgUpgrade rubygem-irbUpgrade rubygemsUpgrade rubygem-json | Sep 18, 2024 | Aug 1, 2024 |
| Rocky_linux | rocky-upgrade-pcsrocky-upgrade-pcs-snmprocky-upgrade-rubyrocky-upgrade-ruby-bundled-gemsrocky-upgrade-ruby-bundled-gems-debuginforocky-upgrade-ruby-debuginforocky-upgrade-ruby-debugsourcerocky-upgrade-ruby-develrocky-upgrade-ruby-libsrocky-upgrade-ruby-libs-debuginforocky-upgrade-rubygem-bigdecimalrocky-upgrade-rubygem-bigdecimal-debuginforocky-upgrade-rubygem-io-consolerocky-upgrade-rubygem-io-console-debuginforocky-upgrade-rubygem-jsonrocky-upgrade-rubygem-json-debuginforocky-upgrade-rubygem-mysql2rocky-upgrade-rubygem-mysql2-debuginforocky-upgrade-rubygem-mysql2-debugsourcerocky-upgrade-rubygem-pgrocky-upgrade-rubygem-pg-debuginforocky-upgrade-rubygem-pg-debugsourcerocky-upgrade-rubygem-psychrocky-upgrade-rubygem-psych-debuginforocky-upgrade-rubygem-raccrocky-upgrade-rubygem-racc-debuginforocky-upgrade-rubygem-rbsrocky-upgrade-rubygem-rbs-debuginfo | Sep 17, 2024 | Aug 1, 2024 | |
| Suse | — | suse-upgrade-libruby2_5-2_5suse-upgrade-ruby2-5suse-upgrade-ruby2-5-develsuse-upgrade-ruby2-5-devel-extrasuse-upgrade-ruby2-5-docsuse-upgrade-ruby2-5-doc-risuse-upgrade-ruby2-5-rubygem-rexmlsuse-upgrade-ruby2-5-rubygem-rexml-docsuse-upgrade-ruby2-5-stdlib | Dec 5, 2025 | Sep 20, 2024 |
| Ubuntu | ubuntu-pro-upgrade-libruby2-3ubuntu-pro-upgrade-libruby2-5ubuntu-pro-upgrade-libruby2-7ubuntu-pro-upgrade-ruby2-3ubuntu-pro-upgrade-ruby2-5ubuntu-upgrade-libruby2-7ubuntu-upgrade-libruby3-0ubuntu-upgrade-libruby3-2ubuntu-upgrade-libruby3-3ubuntu-upgrade-ruby2-7ubuntu-upgrade-ruby3-0ubuntu-upgrade-ruby3-2ubuntu-upgrade-ruby3-3 | Nov 6, 2024 | Aug 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub