CVE-2025-58767: REXML has a DoS condition when parsing malformed XML file

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-17 · updated 2026-06-17
Weakness: CWE-400

Description

REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.

Affected products

ruby rexml: from 3.3.3 before 3.4.2 — fixed in 3.4.2

How to fix

Upgrade to a fixed version: ruby rexml 3.4.2. Check the vendor advisory for mitigations.

References

https://github.com/ruby/rexml/commit/5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23
https://github.com/ruby/rexml/security/advisories/GHSA-c2f4-jgmc-q2r5

Get alerted when CVE-2025-58767 or the next vulnerability affects your stack