CVE-2025-58767

REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.

REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.

Impact

The REXML gems from 3.3.3 to 3.4.1 have a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.

Patches

REXML gems 3.4.2 or later include the patches to fix these vulnerabilities.

Workarounds

Don't parse untrusted XMLs.

References

• https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/ : An announcement on www.ruby-lang.org

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).

Security Fix(es):

REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.(CVE-2025-58767)

Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the use of the + operator when combining URIs. An attacker can obtain sensitive user credentials by crafting a URI that, when merged with another, results in the unintended exposure of authentication information.

Note: This vulnerability is a bypass of the fix to CVE-2025-27221.(CVE-2025-61594)

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• resolv: Denial of Service in resolv gem (CVE-2025-24294)

• rexml: REXML denial of service (CVE-2025-58767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• resolv: Denial of Service in resolv gem (CVE-2025-24294)

• rexml: REXML denial of service (CVE-2025-58767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• resolv: Denial of Service in resolv gem (CVE-2025-24294)

• rexml: REXML denial of service (CVE-2025-58767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• resolv: Denial of Service in resolv gem (CVE-2025-24294)
• rexml: REXML denial of service (CVE-2025-58767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• resolv: Denial of Service in resolv gem (CVE-2025-24294)
• rexml: REXML denial of service (CVE-2025-58767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

• resolv: Denial of Service in resolv gem (CVE-2025-24294)
• rexml: REXML denial of service (CVE-2025-58767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.

REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.

• CVE-2025-58767: fixed REXML to reject duplicate XML declarations and validate declaration attributes to protect from DoS

These are all security issues fixed in the libruby3_4-3_4-3.4.8-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ruby3.4 fixes the following issues:

• CVE-2025-58767: denial of service when parsing XML containing multiple XML declarations (bsc#1250016).
• CVE-2026-27820: insufficient checks in zstream_buffer_ungets can lead to a buffer overflow (bsc#1259239).
• CVE-2026-41316: erb: @_init deserialization guard bypass via def_module / def_method / def_class (bsc#1262441).
• CVE-2026-42258: ruby: Net:IMAP: IMAP Command Injection via Symbol Arguments (bsc#1268011).
• CVE-2026-47240: Net:IMAP: Command Injection via non-synchronizing literal in "raw" argument (bsc#1268337).
• CVE-2026-47241: Net:IMAP: Denial of Service via incomplete raw argument validation (bsc#1268338).
• CVE-2026-47242: Net:IMAP: Command Injection via ID and ENABLE command arguments (bsc#1268339).
• CVE-2025-61594: rubygem-uri: URI concatenation with the plus operator can cause credential disclosure (bsc#1255833).

Changes for ruby3.4:

• Update to 3.4.10.

• Update to 3.4.9:

• Bug #21715: Miscompilation on x86-64-v2 due to undefined behavior in search_nonascii in string.c - Ruby - Ruby Issue Tracking System

• Bug #21787: IO::Buffer Integer Overflow in Range Validation Leads to Out-of-Bounds Memory Access - Ruby - Ruby Issue

• Bug #21757: Splatted args array is mutated when passing unexpected kwargs - Ruby - Ruby Issue Tracking System

• Bug #21326: Instruction generation differences between parse.y and prism for def a(x, ...); b(...); end - Ruby - Ruby Issue

• Bug #21814: 0.pow(2,-9999999999999999990) should be zero - Ruby

• Ruby Issue Tracking System

• Bug #21819: A Data object should be frozen even if it has no members - Ruby - Ruby Issue Tracking System

• Bug #21811: Fix underflow in Array#pack - Ruby - Ruby Issue

• Bug #21838: Rails seeing degradation (20% slowdown) related to Revision 079ef92b "Implement global allocatable slots and empty pages" (from Sep 5 2024) - Ruby - Ruby Issue Tracking System

• Bug #21931: GC Crash in String#% (backport 726205b354d1068147719fb42e1de743f1838ef1) - Ruby - Ruby Issue

• Bug #21860: Process.fork: the child may deadlock on th->interrupt_lock in threadptr_interrupt_exec_cleanup - Ruby - Ruby Issue Tracking System

• Bug #21873: UnboundMethod#== returns false for methods from included/extended modules - Ruby - Ruby Issue Tracking System

• Update to 3.4.8:

  • Bug #21629: Ruby-3.4.7 prints -Wdefault-const-init-field-unsafe warnings on clang / llvm 21 - Ruby - Ruby Issue Tracking System

• Bug #21626: Backport WASI setjmp handler memory leak fixes - Ruby - Ruby Issue Tracking System

• Bug #21631: Backport openssl gem bugfix releases - Ruby - Ruby Issue Tracking System

• Bug #21632: Backport REXML CVE-2025-58767 fix (bsc#1250016) -

• Bug #21644: Stack consistency error for the newrange INSN peephole optimization with chilled string - Ruby - Ruby Issue

• Bug #21668: Improve performance of UnicodeNormalize.canonical_ordering_one - Ruby - Ruby Issue

• Bug #21638: Ractor-local $DEBUG is not marked - Ruby - Ruby

• Bug #21652: Marshal#dump documentation out-of-date/unclear regarding Data class - Ruby - Ruby Issue Tracking System

• Bug #13671: Regexp with lookbehind and case-insensitivity raises RegexpError only on strings with certain characters -

• Bug #21625: Allow IO#wait_readable together with IO#ungetc even in text mode - Ruby - Ruby Issue Tracking System

• Bug #21671: Rails CI raises Assertion Failed: rbimpl_rstring_getmem:RB_TYPE_P(str, RUBY_T_STRING): actual type: 26 with "-DENABLE_PATH_CHECK=0 -DRUBY_DEBUG=1" enabled -

• Update next stable version to 4.0 from 3.5 by hsbt . Pull Request #15146

• Bug #21679: Segfault when ruby calls pthread_detach in rb_getnameinfo - Ruby - Ruby Issue Tracking System

• Bug #21694: Crash when looking up super method from BasicObject

• Ruby - Ruby Issue Tracking System

• Bug #21707: Destructuring assignment of SimpleDelegator wrapped array bug with YJIT - Ruby - Ruby Issue Tracking System

• Bug #21265: Crash when proc from…

This update for ruby2.5 fixes the following issues:

• CVE-2024-49761: ReDoS vulnerability in REXML gem (bsc#1232440 bsc#1232441).
• CVE-2025-58767: denial of service when parsing XML containing multiple XML declarations (bsc#1250016).
• CVE-2026-27820: insufficient checks in zstream_buffer_ungets can lead to a buffer overflow (bsc#1259239).