REXML has DoS condition when parsing malformed XML file

MEDIUM 5.3CVE-2025-58767 · GHSA-c2f4-jgmc-q2r5 · Published 17/09/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
rexml RubyGems	`≥ 3.3.3, < 3.4.2`	`3.4.2`
rexml ruby-lang	`≥ 3.3.3, < 3.4.2`	`3.4.2`

Description

Impact

The REXML gems from 3.3.3 to 3.4.1 have a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.

Patches

REXML gems 3.4.2 or later include the patches to fix these vulnerabilities.

Workarounds

Don't parse untrusted XMLs.

References

https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/ : An announcement on www.ruby-lang.org

NVD description

REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.

References

ruby/rexml security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-58767 · ADVISORY
ruby/rexml commit 5859bde · WEB
ruby/rexml · PACKAGE
rubysec/ruby-advisory-db · WEB
ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free