DescriptionREXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1071626, 1071627

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ruby2.5 (PTS)buster2.5.5-3+deb10u4vulnerable
buster (security)2.5.5-3+deb10u6vulnerable
ruby2.7 (PTS)bullseye (security), bullseye2.7.4-1+deb11u1vulnerable
ruby3.1 (PTS)bookworm3.1.2-7vulnerable
bookworm (security)3.1.2-7+deb12u1vulnerable
sid, trixie3.1.2-8.3vulnerable
ruby3.2 (PTS)sid3.2.3-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[bookworm] - ruby3.1 <no-dsa> (Minor issue)
Fixed by: (v3.2.7)

Search for package or bug name: Reporting problems