GitHub Advisoryadvisory · RubyGems
GHSA-c2f4-jgmc-q2r5 REXML has DoS condition when parsing malformed XML file
LOW
Official page ↗
- Aliases
- CVE-2025-58767
- Ecosystem
- RubyGems
- Packages
- rexml
- Severity
- Low
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
- Weaknesses
- CWE-400, CWE-776
- Reviewed
- 2025-09-17
Affected packages
• RubyGems rexml: >= 3.3.3, < 3.4.2 → fixed in 3.4.2
Description
Impact
The REXML gems from 3.3.3 to 3.4.1 have a DoS vulnerability when parsing XML containing multiple XML declarations.
If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.
Patches
REXML gems 3.4.2 or later include the patches to fix these vulnerabilities.
Workarounds
Don't parse untrusted XMLs.
References
• https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/ : An announcement on www.ruby-lang.org
Related
Alias · CVE (1)
- CVE-2025-58767 REXML is an XML toolkit for Ruby. vulnerability
References
- https://github.com/ruby/rexml/security/advisories/GHSA-c2f4-jgmc-q2r5 web
- https://nvd.nist.gov/vuln/detail/CVE-2025-58767 advisory
- https://github.com/ruby/rexml/commit/5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23 web
- https://github.com/ruby/rexml package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2025-58767.yml web
- https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767 web