CVE-2025-58767
REXML has a DoS condition when parsing malformed XML file
Reported by github_m · Published September 17, 2025
rexml is fixed in 3.4.2 (RubyGems)
REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| rexml | RubyGems | 3.4.2 |
| ruby3.3-fluentd-kubernetes-daemonset-1.18 | Wolfi | 1.18.0.1.0-r5 |
| ruby3.2 | Amazon Linux | 3.2.8-184.amzn2023.0.6 |
| ruby3.1-fluentd-kubernetes-daemonset-1.17 | Wolfi | 1.17.1.1.2-r7 |
| ruby3.2-rubygem-typeprof | Amazon Linux | 0.21.3-184.amzn2023.0.6 |
| ruby3.2-fluentd-kubernetes-daemonset-1.17 | Wolfi | 1.17.1.1.2-r7 |
| jruby-9.4 | Wolfi | 9.4.15.0-r0 |
| ruby3.2-fluentd-kubernetes-daemonset-1.18 | Chainguard | 1.18.0.1.0-r5 |
| ruby3.2-rubygem-power_assert | Amazon Linux | 2.0.3-184.amzn2023.0.6 |
| ruby3.4-fluentd-kubernetes-daemonset-1.16 | Chainguard | 1.16.8.1.0-r4 |
| ruby3.1-fluentd-kubernetes-daemonset-1.18 | Chainguard | 1.18.0.1.0-r6 |
| gitlab-rails-ce-18.3 | Chainguard | 18.3.2-r2 |
16 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| ruby | rexml | >= 3.3.3, < 3.4.2 |
| wolfi | ruby3.3-fluentd-kubernetes-daemonset-1.18 | 0 |
| amazon:2023 | ruby3.2 | 0 |
| wolfi | ruby3.1-fluentd-kubernetes-daemonset-1.17 | 0 |
| amazon:2023 | ruby3.2-rubygem-typeprof | 0 |
| wolfi | ruby3.2-fluentd-kubernetes-daemonset-1.17 | 0 |
| wolfi | jruby-9.4 | 0 |
| chainguard | ruby3.2-fluentd-kubernetes-daemonset-1.18 | 0 |
| amazon:2023 | ruby3.2-rubygem-power_assert | 0 |
| chainguard | ruby3.4-fluentd-kubernetes-daemonset-1.16 | 0 |
| chainguard | ruby3.1-fluentd-kubernetes-daemonset-1.18 | 0 |
| chainguard | gitlab-rails-ce-18.3 | 0 |
| chainguard | truffleruby | 0 |
| amazon:2023 | ruby3.2-bundled-gems | 0 |
| amazon:2023 | ruby3.2-rubygem-test-unit | 0 |
| alpine | ruby-rexml | 0 |
| wolfi | kube-fluentd-operator | 0 |
| wolfi | logstash-9.1 | 0 |
| amazon:2023 | ruby3.2-rubygem-rdoc | 0 |
| wolfi | ruby3.1-fluentd-kubernetes-daemonset-1.18 | 0 |
…and 37 more
Timeline
- Sep 17, 2025 CVE Published
- Sep 18, 2025 EPSS Score (30 in total, the first dated here)
- Oct 4, 2025 Coalition ESS Score (5 in total, the first dated here)
- Dec 8, 2025 Security Advisory (7 in total, the first dated here)
- Oct 28, 2026 CVE Updated
- Nov 2, 2026 Distribution Patch (4 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-58767
vulnetix vdb fixes CVE-2025-58767Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-58767/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/ruby/rexml/security/advisories/GHSA-c2f4-jgmc-q2r5 x_refsource_CONFIRM
- https://github.com/ruby/rexml/commit/5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2025-58767 advisory
- https://github.com/advisories/GHSA-c2f4-jgmc-q2r5 advisory
- https://github.com/ruby/rexml url
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2025-58767.yml advisory
- https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767 url