Ruby Programming Language Rexml
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Ruby Programming Language Rexml.
By the Year
In 2025 there have been 0 vulnerabilities in Ruby Programming Language Rexml. Last year, in 2024 Rexml had 5 security vulnerabilities published. Right now, Rexml is on track to have less security vulnerabilities in 2025 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 0 | 0.00 |
| 2024 | 5 | 5.05 |
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 1 | 7.50 |
It may take a day or so for new Rexml vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Ruby Programming Language Rexml Security Vulnerabilities
REXML 3.3.8 ReDoS via Hex Numeric Ref
CVE-2024-49761
- October 28, 2024
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
ReDoS
REXML DoS via entity expansion in 3.3.2 (fixed 3.3.3)
CVE-2024-41946
5.3 - Medium
- August 01, 2024
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
Resource Exhaustion
REXML XML charset parsing DoS before 3.3.2
CVE-2024-41123
5.3 - Medium
- August 01, 2024
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
Resource Exhaustion
REXML XML gem DoS via special chars, fixed in 3.3.2
CVE-2024-39908
4.3 - Medium
- July 16, 2024
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.
Resource Exhaustion
REXML < 3.2.6 DoS via many '<' in attribute value
CVE-2024-35176
5.3 - Medium
- May 16, 2024
REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
Resource Exhaustion
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues
CVE-2021-28965
7.5 - High
- April 21, 2021
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Ruby Programming Language Rexml or by Ruby Programming Language? Click the Watch button to subscribe.
