GHSA-c2f4-jgmc-q2r5

    Dashboard / Vulnerabilities / GHSA-c2f4-jgmc-q2r5

    GHSA-c2f4-jgmc-q2r5

    Published: 17 Sept 2025Last Modified: 10 Sept 2026

    Summary: REXML has DoS condition when parsing malformed XML file

    Details: ### Impact The REXML gems from 3.3.3 to 3.4.1 have a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. ### Patches REXML gems 3.4.2 or later include the patches to fix these vulnerabilities. ### Workarounds Don't parse untrusted XMLs. ### References * https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/ : An announcement on www.ruby-lang.org

    References: https://github.com/ruby/rexml/security/advisories/GHSA-c2f4-jgmc-q2r5, https://nvd.nist.gov/vuln/detail/CVE-2025-58767, https://github.com/ruby/rexml/commit/5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23, https://github.com/ruby/rexml, https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2025-58767.yml, https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767

    Affected packages

    Package

    Name: rexml

    Purl: pkg:gem/rexml

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 3.3.3
    Fixed -3.4.2

    Affected versions

    3.3.3
    3.3.4
    3.3.5
    3.3.6
    3.3.7
    3.3.8
    3.3.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-c2f4-jgmc-q2r5 | CVE-DB