Known vulnerabilities in REXML

Vendor: rubygems.org
Software: REXML
Software CPE: cpe:2.3:a:rubygems.org:rexml:*:*:*:*:*:*:*:*
Website: https://rubygems.org
Total vulnerabilities: 8
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting REXML REXML is affected by 8 known vulnerabilities: 7 medium, 1 low Critical High Medium Low

Vulnerabilities (8)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU115794 - Resource exhaustion
CVE-2025-58767		 CWE-400 Low
No
No
 3.4.2 18.09.2025 SB2025091868
SB2025102434
SB2025110338
and 12 more
#VU99358 - Inefficient Regular Expression Complexity
CVE-2024-49761		 CWE-1333 Medium
No
No
 3.3.9 28.10.2024 SB2024102837
SB2024110504
SB20241108111
and 38 more
#VU96970 - Resource exhaustion
CVE-2024-43398		 CWE-400 Medium
No
No
 3.3.6 10.09.2024 SB2024091006
SB2024091007
SB2024091008
and 28 more
#VU95149 - Improper input validation
CVE-2024-41123		 CWE-20 Medium
No
No
 3.3.3 01.08.2024 SB2024080145
SB2024091009
SB2024091607
and 24 more
#VU95148 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CVE-2024-41946		 CWE-776 Medium
No
No
 3.3.3 01.08.2024 SB2024080145
SB2024082374
SB2024091607
and 22 more
#VU94363 - Improper input validation
CVE-2024-39908		 CWE-20 Medium
No
No
 3.3.2 16.07.2024 SB2024071616
SB2024083015
SB2024091009
and 22 more
#VU94361 - Improper input validation
CVE-2024-35176		 CWE-20 Medium
Available
No
 3.2.6 16.07.2024 SB2024071615
SB2024071914
SB2024072112
and 19 more
#VU52000 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2021-28965		 CWE-611 Medium
No
No
 3.2.5 08.04.2021 SB2021040816
SB2021041365
SB2021042119
and 24 more