GCVE - cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*

part: a version: * update: *

Vendor	Ruby Lang (`5813a634-c286-5f1d-90d5-a1a352f78d39`)
Product	Rexml (`1c239a90-b832-5917-b3f7-62b250868d4d`)
Edition	*
Language	*
Software edition	*
Target software	ruby
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/ubuntu/ruby-rexml`	purl2cpe	2026-06-01 10:11:45.253233
`pkg:gem/rexml`	purl2cpe	2026-06-01 10:11:45.253235
`pkg:github/ruby/rexml/`	purl2cpe	2026-06-01 10:11:45.253237
`pkg:rpm/opensuse/rubygem-rexml`	purl2cpe	2026-06-01 10:11:45.253238

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-58767`	vulnerable	2026-06-08 07:35:19.512976	REXML has a DoS condition when parsing malformed XML file REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities. Published: 2025-09-17T17:45:58.118Z Updated: 2025-09-17T17:54:00.334Z Open on db.gcve.eu Reference links https://github.com/ruby/rexml/security/advisories/GHSA-c2f4-jgmc-q2r5 https://github.com/ruby/rexml/commit/5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-49761`	vulnerable	2026-06-08 06:50:14.626231	REXML ReDoS vulnerability REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability. Published: 2024-10-28T14:10:23.212Z Updated: 2025-11-03T20:41:10.439Z Open on db.gcve.eu Reference links https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-43398`	vulnerable	2026-06-08 06:45:50.679288	REXML denial of service vulnerability MEDIUM (5.9) REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability. Published: 2024-08-22T14:14:03.588Z Updated: 2025-11-03T20:38:50.990Z Open on db.gcve.eu Reference links https://github.com/ruby/rexml/security/advisories/GHSA-vmwr-mc7x-5vc3 https://github.com/ruby/rexml/releases/tag/v3.3.6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-41946`	vulnerable	2026-06-08 06:43:55.722364	REXML DoS vulnerability MEDIUM (5.3) REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability. Published: 2024-08-01T14:22:14.014Z Updated: 2025-11-03T20:38:34.071Z Open on db.gcve.eu Reference links https://github.com/ruby/rexml/security/advisories/GHSA-5866-49gr-22v4 https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368 https://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-41123`	vulnerable	2026-06-08 06:43:54.026734	REXML DoS vulnerability MEDIUM (5.3) REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities. Published: 2024-08-01T14:18:43.611Z Updated: 2025-11-03T20:38:32.688Z Open on db.gcve.eu Reference links https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6 https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8 https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-39908`	vulnerable	2026-06-08 06:41:51.821456	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-35176`	vulnerable	2026-06-08 06:37:35.382290	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-28965`	vulnerable	2026-06-08 05:31:25.297821	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.