What’s Vulnerable › Vulnerabilities

CVE-2021-28965

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-04-21 · updated 2026-06-17

Description

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

Affected products

• Fedoraproject Fedora: 34
• ruby rexml: before 3.2.5 — fixed in 3.2.5
• Ruby: before 2.6.7; from 2.7.0 before 2.7.3; from 3.0.0 before 3.0.1 — fixed in 2.6.7, 2.7.3, 3.0.1

How to fix

Upgrade to a fixed version: ruby rexml 3.2.5; Ruby 2.6.7, 2.7.3, 3.0.1. Check the vendor advisory for mitigations.

References

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT/
• https://security.netapp.com/advisory/ntap-20210528-0003/
• https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT/
• https://security.netapp.com/advisory/ntap-20210528-0003/
• https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965/

Get alerted when CVE-2021-28965 or the next vulnerability affects your stack