CVE-2024-35176
Fixed in a distro release EPSS 2%CVSS 5.3
REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
Products: ruby rexml, ruby-lang rexml
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | rexml | 3.2.7 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | pcs | 0.10.18-2.el8_10.1 |
| AlmaLinux 8 | pcs-snmp | 0.10.18-2.el8_10.1 |
| AlmaLinux 8 | ruby | 2.5.9-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | ruby-devel | 2.5.9-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | ruby-doc | 2.5.9-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | ruby-irb | 2.5.9-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | ruby-libs | 2.5.9-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-abrt | 0.3.0-4.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-abrt-doc | 0.3.0-4.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-bigdecimal | 1.3.4-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-bson | 4.3.0-2.module_el8.5.0+2625+ec418553 |
| AlmaLinux 8 | rubygem-bson | 4.3.0-2.module_el8.6.0+3170+4b08f9d4 |
| AlmaLinux 8 | rubygem-bson | 4.3.0-2.module_el8.5.0+259+8cec6917 |
| AlmaLinux 8 | rubygem-bson-doc | 4.3.0-2.module_el8.5.0+2625+ec418553 |
| AlmaLinux 8 | rubygem-bundler | 1.16.1-4.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-bundler-doc | 1.16.1-4.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-did_you_mean | 1.2.0-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-io-console | 0.4.6-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-json | 2.1.0-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-minitest | 5.10.3-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-mongo | 2.5.1-2.module_el8.5.0+2625+ec418553 |
| AlmaLinux 8 | rubygem-mongo-doc | 2.5.1-2.module_el8.5.0+2625+ec418553 |
| AlmaLinux 8 | rubygem-mysql2 | 0.4.10-4.module_el8.5.0+259+8cec6917 |
| AlmaLinux 8 | rubygem-mysql2 | 0.4.10-4.module_el8.5.0+2625+ec418553 |
| AlmaLinux 8 | rubygem-mysql2 | 0.4.10-4.module_el8.6.0+3170+4b08f9d4 |
| AlmaLinux 8 | rubygem-mysql2-doc | 0.4.10-4.module_el8.5.0+2625+ec418553 |
| AlmaLinux 8 | rubygem-net-telnet | 0.1.1-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-openssl | 2.1.2-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-pg | 1.0.0-3.module_el8.9.0+3635+c6f99506 |
| AlmaLinux 8 | rubygem-pg-doc | 1.0.0-3.module_el8.9.0+3635+c6f99506 |
| AlmaLinux 8 | rubygem-power_assert | 1.1.1-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-psych | 3.0.2-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-rake | 12.3.3-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-rdoc | 6.0.1.1-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-test-unit | 3.2.7-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygem-xmlrpc | 0.3.0-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygems | 2.7.6.3-112.module_el8.10.0+3871+342e2c2f |
| AlmaLinux 8 | rubygems-devel | 2.7.6.3-112.module_el8.10.0+3871+342e2c2f |
| Amazon Linux 2023 | ruby3.2 | 3.2.7-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-bundled-gems | 3.2.7-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-default-gems | 3.2.7-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-devel | 3.2.7-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-doc | 3.2.7-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-libs | 3.2.7-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-bigdecimal | 3.1.3-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-bundler | 2.4.19-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-io-console | 0.6.0-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-irb | 1.6.2-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-json | 2.6.3-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-minitest | 5.25.1-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-power_assert | 2.0.3-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-psych | 5.0.1-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-rake | 13.0.6-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-rbs | 2.8.2-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-rdoc | 6.5.1.1-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-rexml | 3.3.9-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-rss | 0.3.1-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-test-unit | 3.5.7-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygem-typeprof | 0.21.3-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygems | 3.4.19-183.amzn2023.0.1 |
| Amazon Linux 2023 | ruby3.2-rubygems-devel | 3.4.19-183.amzn2023.0.1 |
| Chainguard | jruby-9.4 | 9.4.8.0-r0 |
| Chainguard | jruby-9.4-default-ruby | 9.4.8.0-r0 |
| Chainguard | kube-fluentd-operator | 1.18.2-r11 |
| Chainguard | kube-fluentd-operator-compat | 1.18.2-r11 |
| Chainguard | kube-fluentd-operator-default-config | 1.18.2-r11 |
| Chainguard | kube-fluentd-operator-oci-entrypoint | 1.18.2-r11 |
| Chainguard | logstash-output-opensearch | 2.0.3-r2 |
| Chainguard | ruby-3.1 | 3.1.6-r2 |
| Chainguard | ruby-3.1-dev | 3.1.6-r2 |
| Chainguard | ruby-3.2 | 3.2.4-r4 |
| Chainguard | ruby-3.2-dev | 3.2.4-r4 |
| Chainguard | ruby-3.2-doc | 3.2.4-r4 |
| Chainguard | ruby-3.3 | 3.3.2-r0 |
| Chainguard | ruby-3.3-base | 3.3.2-r0 |
| Chainguard | ruby-3.3-base-dev | 3.3.2-r0 |
| Chainguard | ruby-3.3-dev | 3.3.2-r0 |
| Chainguard | ruby-3.3-doc | 3.3.2-r0 |
| Chainguard | ruby3.2-rexml | 3.2.8-r0 |
| Debian 11 | ruby2.7 | 2.7.4-1+deb11u3 |
| Debian 12 | ruby3.1 | no fix |
| Red Hat Enterprise Linux 8 | pcs | 0:0.10.18-2.el8_10.1 |
| Red Hat Enterprise Linux 8 | pcs-snmp | 0:0.10.18-2.el8_10.1 |
| Red Hat Enterprise Linux 8 | ruby | 0:2.5.9-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | ruby-debuginfo | 0:2.5.9-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | ruby-debugsource | 0:2.5.9-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | ruby-devel | 0:2.5.9-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | ruby-doc | 0:2.5.9-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | ruby-irb | 0:2.5.9-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | ruby-libs | 0:2.5.9-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | ruby-libs-debuginfo | 0:2.5.9-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-abrt | 0:0.3.0-4.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-abrt-doc | 0:0.3.0-4.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-bigdecimal | 0:1.3.4-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-bigdecimal-debuginfo | 0:1.3.4-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-bson | 0:4.3.0-2.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-bson-debuginfo | 0:4.3.0-2.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-bson-debugsource | 0:4.3.0-2.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-bson-doc | 0:4.3.0-2.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-bundler | 0:1.16.1-4.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-bundler-doc | 0:1.16.1-4.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-did_you_mean | 0:1.2.0-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-io-console | 0:0.4.6-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-io-console-debuginfo | 0:0.4.6-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-json | 0:2.1.0-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-json-debuginfo | 0:2.1.0-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-minitest | 0:5.10.3-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-mongo | 0:2.5.1-2.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-mongo-doc | 0:2.5.1-2.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-mysql2 | 0:0.4.10-4.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-mysql2-debuginfo | 0:0.4.10-4.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-mysql2-debugsource | 0:0.4.10-4.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-mysql2-doc | 0:0.4.10-4.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-net-telnet | 0:0.1.1-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-openssl | 0:2.1.2-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-openssl-debuginfo | 0:2.1.2-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-pg | 0:1.0.0-3.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-pg-debuginfo | 0:1.0.0-3.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-pg-debugsource | 0:1.0.0-3.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-pg-doc | 0:1.0.0-3.module+el8.9.0+19193+435404ae |
| Red Hat Enterprise Linux 8 | rubygem-power_assert | 0:1.1.1-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-psych | 0:3.0.2-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-psych-debuginfo | 0:3.0.2-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-rake | 0:12.3.3-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-rdoc | 0:6.0.1.1-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-test-unit | 0:3.2.7-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygem-xmlrpc | 0:0.3.0-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygems | 0:2.7.6.3-112.module+el8.10.0+22021+135c76a8 |
| Red Hat Enterprise Linux 8 | rubygems-devel | 0:2.7.6.3-112.module+el8.10.0+22021+135c76a8 |
| Rocky Linux 8 | pcs | 0:0.10.18-2.el8_10.1 |
| Rocky Linux 8 | ruby | 0:2.5.9-112.module+el8.10.0+1839+f1f156ae |
| Rocky Linux 8 | rubygem-abrt | 0:0.3.0-4.module+el8.5.0+738+032c9c02 |
| Rocky Linux 8 | rubygem-bson | 0:4.3.0-2.module+el8.9.0+1536+5f79634e |
| Rocky Linux 8 | rubygem-bundler | 0:1.16.1-4.module+el8.9.0+1536+5f79634e |
| Rocky Linux 8 | rubygem-mongo | 0:2.5.1-2.module+el8.9.0+1536+5f79634e |
| Rocky Linux 8 | rubygem-mysql2 | 0:0.4.10-4.module+el8.9.0+1536+5f79634e |
| Rocky Linux 8 | rubygem-pg | 0:1.0.0-3.module+el8.9.0+1536+5f79634e |
| SUSE Enterprise Storage 7.1 | ruby2.5 | 2.5.9-150000.4.32.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | ruby2.5 | 2.5.9-150000.4.32.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | ruby2.5 | 2.5.9-150000.4.32.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | ruby2.5 | 2.5.9-150000.4.32.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | ruby2.5 | 2.5.9-150000.4.32.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | ruby2.5 | 2.5.9-150000.4.32.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | ruby2.5 | 2.5.9-150000.4.32.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | ruby2.5 | 2.5.9-150000.4.32.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | ruby2.5 | 2.5.9-150000.4.32.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | ruby2.5 | 2.5.9-150000.4.32.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | ruby2.5 | 2.5.9-150000.4.32.1 |
| SUSE Manager Server 4.3 | ruby2.5 | 2.5.9-150000.4.32.1 |
| SUSE Package Hub 15 SP6 | rubygem-rexml | 3.3.9-bp156.4.3.1 |
| Ubuntu 16.04 LTS | jruby | no fix |
| Ubuntu 18.04 LTS | jruby | no fix |
| Ubuntu 20.04 LTS | jruby | no fix |
| Ubuntu 20.04 LTS | ruby2.7 | 2.7.0-5ubuntu1.16 |
| Ubuntu 20.04 LTS | ruby2.7 | 2.7.0-5ubuntu1.15 |
| Ubuntu 20.04 LTS | ruby2.7 | 2.7.0-5ubuntu1.18 |
| Ubuntu 22.04 LTS | ruby3.0 | 3.0.2-7ubuntu2.10 |
| Ubuntu 22.04 LTS | ruby3.0 | 3.0.2-7ubuntu2.11 |
| Ubuntu 22.04 LTS | ruby3.0 | 3.0.2-7ubuntu2.8 |
| Ubuntu 24.04 LTS | jruby | no fix |
| Ubuntu 24.04 LTS | ruby3.2 | 3.2.3-1ubuntu0.24.04.6 |
| Ubuntu 24.04 LTS | ruby3.2 | 3.2.3-1ubuntu0.24.04.3 |
| Ubuntu 24.04 LTS | ruby3.2 | 3.2.3-1ubuntu0.24.04.5 |
| Ubuntu 25.10 | jruby | no fix |
| Ubuntu 26.04 LTS | jruby | no fix |
| Ubuntu 26.10 | jruby | no fix |
| Ubuntu Pro 14.04 LTS | jruby | no fix |
| Ubuntu Pro 16.04 LTS | ruby2.3 | 2.3.1-2~ubuntu16.04.16+esm11 |
| Ubuntu Pro 18.04 LTS | ruby2.5 | 2.5.1-1ubuntu1.16+esm6 |
| Ubuntu Pro 18.04 LTS | ruby2.5 | 2.5.1-1ubuntu1.16+esm5 |
| Ubuntu Pro 20.04 LTS | ruby2.7 | 2.7.0-5ubuntu1.18+esm1 |
| Ubuntu Pro 20.04 LTS | ruby2.7 | 2.7.0-5ubuntu1.18+esm3 |
| Wolfi | jruby-9.4 | 9.4.8.0-r0 |
| Wolfi | jruby-9.4-default-ruby | 9.4.8.0-r0 |
| Wolfi | kube-fluentd-operator | 1.18.2-r11 |
| Wolfi | kube-fluentd-operator-compat | 1.18.2-r11 |
| Wolfi | kube-fluentd-operator-default-config | 1.18.2-r11 |
| Wolfi | kube-fluentd-operator-oci-entrypoint | 1.18.2-r11 |
| Wolfi | logstash-output-opensearch | 2.0.3-r2 |
| Wolfi | ruby-3.1 | 3.1.6-r2 |
| Wolfi | ruby-3.1-dev | 3.1.6-r2 |
| Wolfi | ruby-3.2 | 3.2.4-r4 |
| Wolfi | ruby-3.2-dev | 3.2.4-r4 |
| Wolfi | ruby-3.2-doc | 3.2.4-r4 |
| Wolfi | ruby-3.3 | 3.3.2-r0 |
| Wolfi | ruby-3.3-base | 3.3.2-r0 |
| Wolfi | ruby-3.3-base-dev | 3.3.2-r0 |
| Wolfi | ruby-3.3-dev | 3.3.2-r0 |
| Wolfi | ruby-3.3-doc | 3.3.2-r0 |
| Wolfi | ruby3.2-rexml | 3.2.8-r0 |
| openSUSE Leap 15.6 | rubygem-rexml | 3.3.9-bp156.4.3.1 |