Resource exhaustion in REXML - CVE-2025-58767

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU115794

Resource exhaustion in REXML - CVE-2025-58767

Published: September 18, 2025


Vulnerability identifier: #VU115794
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-58767
CWE-ID: CWE-400
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing invalid XML containing multiple XML declarations. A local attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

REXML
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Basesystem Module
openEuler
Fedora
Netcool Operations Insight
IBM License Metric Tool
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
rubygem-rss
rubygem-abrt
rubygem-abrt-doc
rubygem-mysql2
rubygem-mysql2-doc
rubygem-io-console
rubygem-typeprof
rubygem-rbs
rubygem-did_you_mean
rubygem-pg-doc
rubygem-pg
rubygem-racc
rubygem-irb
rubygem-power_assert
rubygem-openssl
rubygem-bundler
rubygem-json
ruby2.5-debuginfo
ruby2.5
libruby2_5-2_5
ruby2.5-debugsource
ruby2.5-devel
ruby2.5-devel-extra
libruby2_5-2_5-debuginfo
ruby2.5-stdlib
ruby2.5-stdlib-debuginfo
rubygem-bigdecimal
ruby-help
ruby-devel
ruby-debugsource
ruby-debuginfo
ruby
ruby-irb
rubygem-rexml
rubygems
rubygems-devel
rubygem-psych
rubygem-test-unit
ruby-default-gems
ruby-libs
ruby-doc
ruby-bundled-gems
ruby (Red Hat package)
rubygem-minitest
rubygem-rdoc
rubygem-rake
IBM Cloud Pak for Multicloud Management

How to mitigate CVE-2025-58767

Install updates from vendor's website.

REXML - update to 3.4.2
Netcool Operations Insight - update to 1.6.15
IBM License Metric Tool - update to 9.2.42
rubygem-rss - update to 0.2.9-144
rubygem-rss - addressed in versions 0.3.1-5, 0.3.1-6
rubygem-abrt - update to 0.4.0-1
rubygem-abrt-doc - update to 0.4.0-1
rubygem-mysql2 - update to 0.5.5-1
rubygem-mysql2-doc - update to 0.5.5-1
rubygem-io-console - update to 0.5.7-144
rubygem-io-console - addressed in versions 0.7.1-5, 0.7.1-6
rubygem-typeprof - update to 0.15.2-144
rubygem-typeprof - addressed in versions 0.21.9-5, 0.21.9-6
rubygem-rbs - update to 1.4.0-144
rubygem-did_you_mean - update to 1.5.0-144
rubygem-pg-doc - update to 1.5.4-1
rubygem-pg - update to 1.5.4-1
rubygem-racc - addressed in versions 1.7.3-5, 1.7.3-6
rubygem-irb - addressed in versions 1.13.1-5, 1.13.1-6
rubygem-power_assert - addressed in versions 2.0.3-5, 2.0.3-6
rubygem-openssl - update to 2.2.1-144
rubygem-bundler - update to 2.2.32-144
IBM Cloud Pak for Multicloud Management - update to 2.3 Fix Pack 12
rubygem-json - update to 2.5.1-144
ruby2.5-debuginfo - update to 2.5.9-150700.24.6.1
ruby2.5 - update to 2.5.9-150700.24.6.1
libruby2_5-2_5 - update to 2.5.9-150700.24.6.1
ruby2.5-debugsource - update to 2.5.9-150700.24.6.1
ruby2.5-devel - update to 2.5.9-150700.24.6.1
ruby2.5-devel-extra - update to 2.5.9-150700.24.6.1
libruby2_5-2_5-debuginfo - update to 2.5.9-150700.24.6.1
ruby2.5-stdlib - update to 2.5.9-150700.24.6.1
ruby2.5-stdlib-debuginfo - update to 2.5.9-150700.24.6.1
rubygem-bundler - addressed in versions 2.5.22-5, 2.5.22-6
rubygem-json - addressed in versions 2.7.2-5, 2.7.2-6
rubygem-bigdecimal - update to 3.0.0-144
ruby-help - update to 3.0.3-144
ruby-devel - update to 3.0.3-144
ruby-debugsource - update to 3.0.3-144
ruby-debuginfo - update to 3.0.3-144
ruby - update to 3.0.3-144
ruby-irb - update to 3.0.3-144
rubygem-bigdecimal - addressed in versions 3.1.5-5, 3.1.5-6
rubygem-rexml - update to 3.2.5-144
rubygems - update to 3.2.32-144
rubygems-devel - update to 3.2.32-144
rubygem-psych - update to 3.3.2-144
rubygem-test-unit - update to 3.3.7-144
ruby-default-gems - addressed in versions 3.3.9-6, 3.3.10-5
ruby-libs - addressed in versions 3.3.9-6, 3.3.10-5
ruby-doc - addressed in versions 3.3.9-6, 3.3.10-5
ruby-devel - addressed in versions 3.3.9-6, 3.3.10-5
rubygem-rexml - addressed in versions 3.3.9-6, 3.4.4-5
ruby-bundled-gems - addressed in versions 3.3.9-6, 3.3.10-5
ruby - addressed in versions 3.3.9-6, 3.3.10-5
ruby (Red Hat package) - addressed in versions 3.3.10-11.el10_0, 3.3.10-11.el10_1
ruby - addressed in versions 3.3.10-21.fc41, 3.4.7-26.fc42
rubygem-rbs - addressed in versions 3.4.0-5, 3.4.0-6
rubygems - addressed in versions 3.5.22-5, 3.5.22-6
rubygems-devel - addressed in versions 3.5.22-5, 3.5.22-6
rubygem-test-unit - addressed in versions 3.6.1-5, 3.6.1-6
rubygem-psych - addressed in versions 5.1.2-5, 5.1.2-6
rubygem-minitest - update to 5.14.2-144
rubygem-minitest - addressed in versions 5.20.0-5, 5.20.0-6
rubygem-rdoc - update to 6.3.3-144
rubygem-rdoc - addressed in versions 6.6.3.1-5, 6.6.3.1-6
rubygem-rake - update to 13.0.3-144
rubygem-rake - addressed in versions 13.1.0-5, 13.1.0-6

External References

Related Security Bulletins