{"id":"CVE-2024-35176","aliases":["ALSA-2024:4499","ALSA-2024:5338","AZL-42052","AZL-42064","AZL-42070","AZL-42076","DEBIAN-CVE-2024-35176","DLA-4018-1","EUVD-2024-1802","GHSA-vg3r-rm7w-2xgh","MGASA-2025-0001","OESA-2024-1824","RHSA-2024:4499","RHSA-2024:5338","RLSA-2024:4499","RLSA-2024:5338","SUSE-SU-2024:3874-1","UBUNTU-CVE-2024-35176","USN-7091-1","USN-7091-2","USN-7418-1","USN-7734-1","USN-7840-1","openSUSE-SU-2025:0129-1"],"status":"published","title":"REXML contains a denial of service vulnerability","description":"REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `\u003c`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02064,"percentile":0.81504,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2024-05-16T15:13:25Z","modified":"2026-11-02T12:02:31Z","exploits":[{"source":"pocgithub","id":"SpiralBL0CK/CVE-2024-35176","title":"SpiralBL0CK/CVE-2024-35176","date":"2024-12-19","url":"https://github.com/SpiralBL0CK/CVE-2024-35176"}],"fixes":[{"ecosystem":"RubyGems","package":"rexml","fixed_in":["3.2.7"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:8","package":"pcs","fixed_in":["0.10.18-2.el8_10.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"pcs-snmp","fixed_in":["0.10.18-2.el8_10.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"ruby","fixed_in":["3.3.3-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rubygem-rexml","fixed_in":["3.2.8-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"ruby","fixed_in":["3.1.4-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"rubygem-rexml","fixed_in":["3.2.7-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"ruby","fixed_in":["3.0.3-136.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"ruby","fixed_in":["2.5.8-126.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"ruby","fixed_in":["3.2.2-142.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"ruby","fixed_in":["3.0.3-136.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"ruby","fixed_in":["3.0.3-136.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs","fixed_in":["0:0.10.18-2.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs-snmp","fixed_in":["0:0.10.18-2.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs","fixed_in":["0:0.10.18-2.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.10.18-2.el8_10.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"pcs","fixed_in":["0:0.10.18-2.el8_10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby2.3","fixed_in":["2.3.1-2~ubuntu16.04.16+esm11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby2.5","fixed_in":["2.5.1-1ubuntu1.16+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"ruby2.7","fixed_in":["2.7.0-5ubuntu1.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ruby3.0","fixed_in":["3.0.2-7ubuntu2.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"ruby3.2","fixed_in":["3.2.3-1ubuntu0.24.04.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-4.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-abrt-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-4.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-2.module_el8.5.0+2625+ec418553"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-2.module_el8.6.0+3170+4b08f9d4"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-2.module_el8.5.0+259+8cec6917"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bson-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-2.module_el8.5.0+2625+ec418553"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-4.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-bundler-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-4.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-did_you_mean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.6-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.3-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-2.module_el8.5.0+2625+ec418553"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mongo-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-2.module_el8.5.0+2625+ec418553"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.10-4.module_el8.5.0+259+8cec6917"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.10-4.module_el8.5.0+2625+ec418553"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.10-4.module_el8.6.0+3170+4b08f9d4"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.10-4.module_el8.5.0+2625+ec418553"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-net-telnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-3.module_el8.9.0+3635+c6f99506"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-3.module_el8.9.0+3635+c6f99506"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.3-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.1.1-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygem-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6.3-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6.3-112.module_el8.10.0+3871+342e2c2f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8_10.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.18-2.el8_10.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-7","3.1.2-7+deb12u1","3.1.2-7+hurd.1","3.1.2-8","3.1.2-8.1~exp1","3.1.2-8.3","3.1.2-8.4","3.1.2-8.5"]},{"source":"osv","ecosystem":"Debian:11","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-1+deb11u3"}]}],"versions":["2.7.4-1","2.7.4-1+deb11u1","2.7.4-1+deb11u2"],"bundled":6},{"source":"osv","ecosystem":"RubyGems","package":"rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7"}]}],"versions":["3.1.7.3","3.1.8","3.1.9","3.1.9.1","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6"]},{"source":"osv","ecosystem":"Mageia:9","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-46.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-136.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.8-126.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-142.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-136.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-136.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ruby-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-abrt-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.4-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bigdecimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.4-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-2.module+el8.9.0+19193+435404ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-2.module+el8.9.0+19193+435404ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bson-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-2.module+el8.9.0+19193+435404ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bson-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-2.module+el8.9.0+19193+435404ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-bundler-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-did_you_mean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.6-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-io-console-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.6-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-json-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.3-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-2.module+el8.9.0+19193+435404ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mongo-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-2.module+el8.9.0+19193+435404ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.10-4.module+el8.9.0+19193+435404ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.10-4.module+el8.9.0+19193+435404ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.10-4.module+el8.9.0+19193+435404ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.10-4.module+el8.9.0+19193+435404ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-net-telnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.1-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.2-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.2-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-3.module+el8.9.0+19193+435404ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-3.module+el8.9.0+19193+435404ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-3.module+el8.9.0+19193+435404ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-3.module+el8.9.0+19193+435404ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.1-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.2-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-psych-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.2-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.3.3-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1.1-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.7-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygem-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6.3-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6.3-112.module+el8.10.0+22021+135c76a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.9-112.module+el8.10.0+1839+f1f156ae"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-abrt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.5.0+738+032c9c02"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-bson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-2.module+el8.9.0+1536+5f79634e"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.1-4.module+el8.9.0+1536+5f79634e"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-mongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-2.module+el8.9.0+1536+5f79634e"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.10-4.module+el8.9.0+1536+5f79634e"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-3.module+el8.9.0+1536+5f79634e"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.18-2.el8_10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.32.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.32.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.32.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.32.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.32.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.32.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.32.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.32.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.32.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.32.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.32.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.9-150000.4.32.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.6-5ubuntu1","1.5.6-6","1.5.6-7","1.5.6-9+deb8u2build0.14.04.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+esm11"}]}],"versions":["2.3.0-1","2.3.0-2","2.3.0-4ubuntu2","2.3.0-4ubuntu3","2.3.0-5ubuntu1","2.3.1-2~16.04","2.3.1-2~16.04.2","2.3.1-2~16.04.4","2.3.1-2~16.04.5","2.3.1-2~16.04.6","2.3.1-2~16.04.7","2.3.1-2~16.04.9","2.3.1-2~16.04.10","2.3.1-2~16.04.11","2.3.1-2~16.04.12","2.3.1-2~ubuntu16.04.13","2.3.1-2~ubuntu16.04.14","2.3.1-2~ubuntu16.04.15","2.3.1-2~ubuntu16.04.16","2.3.1-2~ubuntu16.04.16+esm1","2.3.1-2~ubuntu16.04.16+esm2","2.3.1-2~ubuntu16.04.16+esm3","2.3.1-2~ubuntu16.04.16+esm4","2.3.1-2~ubuntu16.04.16+esm5","2.3.1-2~ubuntu16.04.16+esm6","2.3.1-2~ubuntu16.04.16+esm7","2.3.1-2~ubuntu16.04.16+esm8","2.3.1-2~ubuntu16.04.16+esm9","2.3.1-2~ubuntu16.04.16+esm10"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.21-2ubuntu4","1.7.22-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+esm5"}]}],"versions":["2.5.0~preview1-1ubuntu2","2.5.0-4ubuntu1","2.5.0-4ubuntu4","2.5.0-5ubuntu1","2.5.0-6ubuntu1","2.5.1-1ubuntu1","2.5.1-1ubuntu1.1","2.5.1-1ubuntu1.2","2.5.1-1ubuntu1.4","2.5.1-1ubuntu1.5","2.5.1-1ubuntu1.6","2.5.1-1ubuntu1.7","2.5.1-1ubuntu1.8","2.5.1-1ubuntu1.9","2.5.1-1ubuntu1.10","2.5.1-1ubuntu1.11","2.5.1-1ubuntu1.12","2.5.1-1ubuntu1.13","2.5.1-1ubuntu1.14","2.5.1-1ubuntu1.15","2.5.1-1ubuntu1.16","2.5.1-1ubuntu1.16+esm1","2.5.1-1ubuntu1.16+esm3","2.5.1-1ubuntu1.16+esm4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.1.13.0-1","9.1.17.0-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.16"}]}],"versions":["2.7.0-1","2.7.0-2","2.7.0-3","2.7.0-4","2.7.0-4ubuntu1","2.7.0-5ubuntu1","2.7.0-5ubuntu1.1","2.7.0-5ubuntu1.2","2.7.0-5ubuntu1.3","2.7.0-5ubuntu1.4","2.7.0-5ubuntu1.5","2.7.0-5ubuntu1.6","2.7.0-5ubuntu1.7","2.7.0-5ubuntu1.8","2.7.0-5ubuntu1.9","2.7.0-5ubuntu1.10","2.7.0-5ubuntu1.11","2.7.0-5ubuntu1.12","2.7.0-5ubuntu1.13","2.7.0-5ubuntu1.14","2.7.0-5ubuntu1.15"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.1.17.0-3","9.1.17.0-3build5","9.1.17.0-3build6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-7ubuntu2.10"}]}],"versions":["3.0.2-5ubuntu1","3.0.2-7","3.0.2-7ubuntu2","3.0.2-7ubuntu2.1","3.0.2-7ubuntu2.2","3.0.2-7ubuntu2.3","3.0.2-7ubuntu2.4","3.0.2-7ubuntu2.5","3.0.2-7ubuntu2.6","3.0.2-7ubuntu2.7","3.0.2-7ubuntu2.8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.3.9.0+ds-1","9.4.5.0+ds-1","9.4.5.0+ds-1ubuntu1","9.4.6.0+ds-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-1ubuntu0.24.04.5"}]}],"versions":["3.2.3-1","3.2.3-1build2","3.2.3-1build3","3.2.3-1ubuntu0.24.04.1","3.2.3-1ubuntu0.24.04.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.8.0+ds-2ubuntu1","9.4.8.0+ds-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.8.0+ds-3ubuntu1","9.4.14.0+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.8.0+ds-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-7ubuntu2.8"}]}],"versions":["3.0.2-5ubuntu1","3.0.2-7","3.0.2-7ubuntu2","3.0.2-7ubuntu2.1","3.0.2-7ubuntu2.2","3.0.2-7ubuntu2.3","3.0.2-7ubuntu2.4","3.0.2-7ubuntu2.5","3.0.2-7ubuntu2.6","3.0.2-7ubuntu2.7"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-1ubuntu0.24.04.3"}]}],"versions":["3.2.3-1","3.2.3-1build2","3.2.3-1build3","3.2.3-1ubuntu0.24.04.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.15"}]}],"versions":["2.7.0-1","2.7.0-2","2.7.0-3","2.7.0-4","2.7.0-4ubuntu1","2.7.0-5ubuntu1","2.7.0-5ubuntu1.1","2.7.0-5ubuntu1.2","2.7.0-5ubuntu1.3","2.7.0-5ubuntu1.4","2.7.0-5ubuntu1.5","2.7.0-5ubuntu1.6","2.7.0-5ubuntu1.7","2.7.0-5ubuntu1.8","2.7.0-5ubuntu1.9","2.7.0-5ubuntu1.10","2.7.0-5ubuntu1.11","2.7.0-5ubuntu1.12","2.7.0-5ubuntu1.13","2.7.0-5ubuntu1.14"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18"}]}],"versions":["2.7.0-1","2.7.0-2","2.7.0-3","2.7.0-4","2.7.0-4ubuntu1","2.7.0-5ubuntu1","2.7.0-5ubuntu1.1","2.7.0-5ubuntu1.2","2.7.0-5ubuntu1.3","2.7.0-5ubuntu1.4","2.7.0-5ubuntu1.5","2.7.0-5ubuntu1.6","2.7.0-5ubuntu1.7","2.7.0-5ubuntu1.8","2.7.0-5ubuntu1.9","2.7.0-5ubuntu1.10","2.7.0-5ubuntu1.11","2.7.0-5ubuntu1.12","2.7.0-5ubuntu1.13","2.7.0-5ubuntu1.14","2.7.0-5ubuntu1.15","2.7.0-5ubuntu1.16","2.7.0-5ubuntu1.17"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-7ubuntu2.10"}]}],"versions":["3.0.2-5ubuntu1","3.0.2-7","3.0.2-7ubuntu2","3.0.2-7ubuntu2.1","3.0.2-7ubuntu2.2","3.0.2-7ubuntu2.3","3.0.2-7ubuntu2.4","3.0.2-7ubuntu2.5","3.0.2-7ubuntu2.6","3.0.2-7ubuntu2.7","3.0.2-7ubuntu2.8"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-1ubuntu0.24.04.5"}]}],"versions":["3.2.3-1","3.2.3-1build2","3.2.3-1build3","3.2.3-1ubuntu0.24.04.1","3.2.3-1ubuntu0.24.04.3"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+esm5"}]}],"versions":["2.5.0~preview1-1ubuntu2","2.5.0-4ubuntu1","2.5.0-4ubuntu4","2.5.0-5ubuntu1","2.5.0-6ubuntu1","2.5.1-1ubuntu1","2.5.1-1ubuntu1.1","2.5.1-1ubuntu1.2","2.5.1-1ubuntu1.4","2.5.1-1ubuntu1.5","2.5.1-1ubuntu1.6","2.5.1-1ubuntu1.7","2.5.1-1ubuntu1.8","2.5.1-1ubuntu1.9","2.5.1-1ubuntu1.10","2.5.1-1ubuntu1.11","2.5.1-1ubuntu1.12","2.5.1-1ubuntu1.13","2.5.1-1ubuntu1.14","2.5.1-1ubuntu1.15","2.5.1-1ubuntu1.16","2.5.1-1ubuntu1.16+esm1","2.5.1-1ubuntu1.16+esm3","2.5.1-1ubuntu1.16+esm4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+esm1"}]}],"versions":["2.7.0-1","2.7.0-2","2.7.0-3","2.7.0-4","2.7.0-4ubuntu1","2.7.0-5ubuntu1","2.7.0-5ubuntu1.1","2.7.0-5ubuntu1.2","2.7.0-5ubuntu1.3","2.7.0-5ubuntu1.4","2.7.0-5ubuntu1.5","2.7.0-5ubuntu1.6","2.7.0-5ubuntu1.7","2.7.0-5ubuntu1.8","2.7.0-5ubuntu1.9","2.7.0-5ubuntu1.10","2.7.0-5ubuntu1.11","2.7.0-5ubuntu1.12","2.7.0-5ubuntu1.13","2.7.0-5ubuntu1.14","2.7.0-5ubuntu1.15","2.7.0-5ubuntu1.16","2.7.0-5ubuntu1.17","2.7.0-5ubuntu1.18"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-7ubuntu2.11"}]}],"versions":["3.0.2-5ubuntu1","3.0.2-7","3.0.2-7ubuntu2","3.0.2-7ubuntu2.1","3.0.2-7ubuntu2.2","3.0.2-7ubuntu2.3","3.0.2-7ubuntu2.4","3.0.2-7ubuntu2.5","3.0.2-7ubuntu2.6","3.0.2-7ubuntu2.7","3.0.2-7ubuntu2.8","3.0.2-7ubuntu2.10"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-1ubuntu0.24.04.6"}]}],"versions":["3.2.3-1","3.2.3-1build2","3.2.3-1build3","3.2.3-1ubuntu0.24.04.1","3.2.3-1ubuntu0.24.04.3","3.2.3-1ubuntu0.24.04.5"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+esm11"}]}],"versions":["2.3.0-1","2.3.0-2","2.3.0-4ubuntu2","2.3.0-4ubuntu3","2.3.0-5ubuntu1","2.3.1-2~16.04","2.3.1-2~16.04.2","2.3.1-2~16.04.4","2.3.1-2~16.04.5","2.3.1-2~16.04.6","2.3.1-2~16.04.7","2.3.1-2~16.04.9","2.3.1-2~16.04.10","2.3.1-2~16.04.11","2.3.1-2~16.04.12","2.3.1-2~ubuntu16.04.13","2.3.1-2~ubuntu16.04.14","2.3.1-2~ubuntu16.04.15","2.3.1-2~ubuntu16.04.16","2.3.1-2~ubuntu16.04.16+esm1","2.3.1-2~ubuntu16.04.16+esm2","2.3.1-2~ubuntu16.04.16+esm3","2.3.1-2~ubuntu16.04.16+esm4","2.3.1-2~ubuntu16.04.16+esm5","2.3.1-2~ubuntu16.04.16+esm6","2.3.1-2~ubuntu16.04.16+esm7","2.3.1-2~ubuntu16.04.16+esm8","2.3.1-2~ubuntu16.04.16+esm9","2.3.1-2~ubuntu16.04.16+esm10"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.16+esm6"}]}],"versions":["2.5.0~preview1-1ubuntu2","2.5.0-4ubuntu1","2.5.0-4ubuntu4","2.5.0-5ubuntu1","2.5.0-6ubuntu1","2.5.1-1ubuntu1","2.5.1-1ubuntu1.1","2.5.1-1ubuntu1.2","2.5.1-1ubuntu1.4","2.5.1-1ubuntu1.5","2.5.1-1ubuntu1.6","2.5.1-1ubuntu1.7","2.5.1-1ubuntu1.8","2.5.1-1ubuntu1.9","2.5.1-1ubuntu1.10","2.5.1-1ubuntu1.11","2.5.1-1ubuntu1.12","2.5.1-1ubuntu1.13","2.5.1-1ubuntu1.14","2.5.1-1ubuntu1.15","2.5.1-1ubuntu1.16","2.5.1-1ubuntu1.16+esm1","2.5.1-1ubuntu1.16+esm3","2.5.1-1ubuntu1.16+esm4","2.5.1-1ubuntu1.16+esm5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.18+esm3"}]}],"versions":["2.7.0-1","2.7.0-2","2.7.0-3","2.7.0-4","2.7.0-4ubuntu1","2.7.0-5ubuntu1","2.7.0-5ubuntu1.1","2.7.0-5ubuntu1.2","2.7.0-5ubuntu1.3","2.7.0-5ubuntu1.4","2.7.0-5ubuntu1.5","2.7.0-5ubuntu1.6","2.7.0-5ubuntu1.7","2.7.0-5ubuntu1.8","2.7.0-5ubuntu1.9","2.7.0-5ubuntu1.10","2.7.0-5ubuntu1.11","2.7.0-5ubuntu1.12","2.7.0-5ubuntu1.13","2.7.0-5ubuntu1.14","2.7.0-5ubuntu1.15","2.7.0-5ubuntu1.16","2.7.0-5ubuntu1.17","2.7.0-5ubuntu1.18","2.7.0-5ubuntu1.18+esm1"],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.9-bp156.4.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.9-bp156.4.3.1"}]}],"bundled":6}],"products":[{"vendor":"ruby","product":"rexml"},{"vendor":"ruby-lang","product":"rexml"}],"references":[{"url":"https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web","article"]},{"url":"https://security.netapp.com/advisory/ntap-20250306-0001/","tags":["Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35176","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250306-0001","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vg3r-rm7w-2xgh"},{"url":"https://access.redhat.com/errata/RHSA-2024:4499","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-36617","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-27280","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-27281","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-27282","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-35176","tags":["report"]},{"url":"https://bugzilla.redhat.com/2218614","tags":["report"]},{"url":"https://bugzilla.redhat.com/2270749","tags":["report"]},{"url":"https://bugzilla.redhat.com/2270750","tags":["report"]},{"url":"https://bugzilla.redhat.com/2276810","tags":["report"]},{"url":"https://bugzilla.redhat.com/2280894","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-4499.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5338","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-5338.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35176.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-35176","tags":["advisory"]},{"url":"https://github.com/ruby/rexml","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0001.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33576","tags":["report"]},{"url":"https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/","tags":["web"]},{"url":"https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908/","tags":["web"]},{"url":"https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123/","tags":["web"]},{"url":"https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41946/","tags":["web"]},{"url":"https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQWXWS2GDTKX4LYWHQOZ2PWXDEICDX2W/","tags":["web"]},{"url":"https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-7091-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1824","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2280894","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4499.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-36617","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36617","tags":["advisory"]},{"url":"https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27280","tags":["advisory"]},{"url":"https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27281","tags":["advisory"]},{"url":"https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27282","tags":["advisory"]},{"url":"https://www.ruby-lang.org/en/news/2024/04/23/arbitrary-memory-address-read-regexp-cve-2024-27282/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-35176","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5338.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:4499","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:5338","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243874-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224390","tags":["report"]},{"url":"https://bugzilla.suse.com/1228072","tags":["report"]},{"url":"https://bugzilla.suse.com/1228794","tags":["report"]},{"url":"https://bugzilla.suse.com/1228799","tags":["report"]},{"url":"https://bugzilla.suse.com/1229673","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43398","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-35176","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7091-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7418-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7734-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7840-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-39908","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-41946","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49761","tags":["report"]},{"url":"https://launchpad.net/bugs/2086615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-43398","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-25186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-27219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-27220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-27221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-27282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-24294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-47220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-6442","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DGKHOJBF7CZTZV4MBBSARWRERGVICQZ5/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232440","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49761","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-35176","title":"REXML contains a denial of service vulnerability","description":" REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `\u003c`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.","status":"published","published":"2024-05-16T15:13:25.1Z","modified":"2025-11-03T20:37:32.949Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:34:20.313092Z"}],"euvd":[{"id":"EUVD-2024-1802","description":" REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `\u003c`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.","status":"published","published":"2024-05-16T15:13:25Z","modified":"2025-11-03T20:37:32Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:32.126029Z"}],"ghsa":[{"id":"GHSA-vg3r-rm7w-2xgh","title":"REXML contains a denial of service vulnerability","description":"### Impact\n\nThe REXML gem before 3.2.6 has a DoS vulnerability when it parses an XML that has many `\u003e`s in an attribute value.\n\nIf you need to parse untrusted XMLs, you may be impacted to this vulnerability.\n\n### Patches\n\nThe REXML gem 3.2.7 or later include the patch to fix this vulnerability.\n\n### Workarounds\n\nDon't parse untrusted XMLs.\n\n### References\n\n* https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/","status":"published","published":"2024-05-16T17:44:04Z","modified":"2025-11-03T22:46:49Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:39:05.278442Z"}],"nvd":[{"id":"CVE-2024-35176","description":" REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `\u003c`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.","status":"published","published":"2024-05-16T16:15:09.707Z","modified":"2026-06-17T07:34:29.257Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:09:59.094954Z"}],"osv":[{"id":"CVE-2024-35176","title":"REXML contains a denial of service vulnerability","description":" REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `\u003c`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.","status":"published","published":"2024-05-16T15:13:25.1Z","modified":"2026-10-28T02:30:23.625395636Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"DEBIAN-CVE-2024-35176","description":"REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `\u003c`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.","status":"published","published":"2024-05-16T16:15:09.707Z","modified":"2026-11-02T12:02:31.368687525Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-vg3r-rm7w-2xgh","title":"REXML contains a denial of service vulnerability","description":"### Impact\n\nThe REXML gem before 3.2.6 has a DoS vulnerability when it parses an XML that has many `\u003e`s in an attribute value.\n\nIf you need to parse untrusted XMLs, you may be impacted to this vulnerability.\n\n### Patches\n\nThe REXML gem 3.2.7 or later include the patch to fix this vulnerability.\n\n### Workarounds\n\nDon't parse untrusted XMLs.\n\n### References\n\n* https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/","status":"published","published":"2024-05-16T17:44:04Z","modified":"2026-09-10T03:50:14.352438622Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"OESA-2024-1824","title":"ruby security update","description":"Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl).\n\nSecurity Fix(es):\n\n REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `\u0026lt;`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don\u0026apos;t parse untrusted XMLs.(CVE-2024-35176)","status":"published","published":"2024-07-12T11:07:17Z","modified":"2026-08-18T01:18:29.506328294Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2024:4499","title":"Red Hat Security Advisory: ruby security update","status":"published","published":"2024-10-10T17:02:53Z","modified":"2026-08-20T10:07:46Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:5338","title":"Red Hat Security Advisory: pcs security update","status":"published","published":"2024-09-28T00:24:43Z","modified":"2026-06-29T11:00:24Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RLSA-2024:5338","title":"Low: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* REXML: DoS parsing an XML with many `\u003c`s in an attribute value (CVE-2024-35176)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:11:49.809358Z","modified":"2025-05-07T20:08:47.080382Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2024-35176","description":"REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `\u003c`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.","status":"published","published":"2024-05-16T16:15:00Z","modified":"2026-10-17T12:56:36.915688079Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:50.784131Z"},{"id":"ALSA-2024:4499","title":"Moderate: ruby security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* rubygem-uri: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)\n* ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)\n* ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)\n* ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)\n* REXML: DoS parsing an XML with many `\u003c`s in an attribute value (CVE-2024-35176)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-07-11T00:00:00Z","modified":"2026-10-29T11:02:28.032478547Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:5338","title":"Low: pcs security update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* REXML: DoS parsing an XML with many `\u003c`s in an attribute value (CVE-2024-35176)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-08-13T00:00:00Z","modified":"2026-10-29T11:02:21.514119674Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"AZL-42052","title":"CVE-2024-35176 affecting package ruby for versions less than 3.3.3-1","description":" REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `\u003c`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.","status":"published","published":"2024-05-16T16:15:09Z","modified":"2026-04-21T04:47:59.199166Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-42064","title":"CVE-2024-35176 affecting package rubygem-rexml for versions less than 3.2.8-1","description":" REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `\u003c`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.","status":"published","published":"2024-05-16T16:15:09Z","modified":"2026-04-21T04:52:31.901362Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-42070","title":"CVE-2024-35176 affecting package ruby for versions less than 3.1.4-6","description":" REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `\u003c`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.","status":"published","published":"2024-05-16T16:15:09Z","modified":"2026-04-21T04:29:24.356512Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-42076","title":"CVE-2024-35176 affecting package rubygem-rexml for versions less than 3.2.7-1","description":" REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `\u003c`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.","status":"published","published":"2024-05-16T16:15:09Z","modified":"2026-04-21T04:29:23.804822Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"DLA-4018-1","title":"ruby2.7 - security update","status":"published","published":"2025-01-17T00:00:00Z","modified":"2026-03-09T02:09:55.813564Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2025-0001","title":"Updated ruby packages fix security vulnerabilities","description":"The REXML gem before 3.2.6 has a denial of service vulnerability when it\nparses an XML that has many `\u003c`s in an attribute value. (CVE-2024-35176)\nThe REXML gem before 3.3.1 has some DoS vulnerabilities when it parses\nan XML that has many specific characters such as `\u003c`, `0` and `%\u003e`.\n(CVE-2024-39908)\nThe REXML gem before 3.3.2 has some DoS vulnerabilities when it parses\nan XML that has many specific characters such as whitespace character,\n`\u003e]` and `]\u003e`. (CVE-2024-41123)\nThe REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that\nhas many entity expansions with SAX2 or pull parser API.\n(CVE-2024-41946)\nThe REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML\nthat has many deep elements that have same local name attributes.\n(CVE-2024-43398)\nThe REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an\nXML that has many digits between \u0026# and x...; in a hex numeric character\nreference (\u0026#x...;). (CVE-2024-49761)\n","status":"published","published":"2025-01-04T21:09:30Z","modified":"2026-04-16T04:44:45.519585803Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2025:0129-1","title":"Security update for rubygem-rexml","description":"\nrubygem-rexml was updated to 3.3.9:\n\n- fixes CVE-2024-49761, CVE-2024-43398, CVE-2024-41946,\n  CVE-2024-41123, CVE-2024-39908, CVE-2024-35176\n- bsc#1232440, bsc#1229673, bsc#1228799, bsc#1228794,\n  bsc#1228072, bsc#1224390","status":"published","published":"2025-04-17T04:01:39Z","modified":"2026-02-04T04:06:24.121318Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"RLSA-2024:4499","title":"Moderate: ruby security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* rubygem-uri: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)\n\n* ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280)\n\n* ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281)\n\n* ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282)\n\n* REXML: DoS parsing an XML with many `\u003c`s in an attribute value (CVE-2024-35176)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-07-15T12:17:49.133583Z","modified":"2026-02-05T00:30:15.472537Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2024:3874-1","title":"Security update for ruby2.5","description":"This update for ruby2.5 fixes the following issues:\n\n- CVE-2024-43398: Fixed DoS when parsing a XML that has many deep elements with the same local name attributes (bsc#1229673)\n- CVE-2024-41123: Fixed DoS when parsing an XML that contains many specific characters such as whitespaces, \u003e] and ]\u003e (bsc#1228794)\n- CVE-2024-41946: Fixed DoS when parsing an XML that has many entity expansions with SAX2 or pull parser API (bsc#1228799)\n- CVE-2024-35176: Fixed DoS when parsing an XML that has many left angled brackets in an attribute value (bsc#1224390)\n- CVE-2024-39908: Fixed ReDos when parsing an XML that has many specific characters (bsc#1228072)\n","status":"published","published":"2024-11-01T15:25:48Z","modified":"2026-02-04T04:01:32.480897Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-7091-1","title":"ruby3.0, ruby3.2, ruby3.3 vulnerabilities","description":"It was discovered that Ruby incorrectly handled parsing of an XML document\nthat has specific XML characters in an attribute value using REXML gem. An\nattacker could use this issue to cause Ruby to crash, resulting in a denial\nof service. This issue only affected in Ubuntu 22.04 LTS and Ubuntu 24.04\nLTS. (CVE-2024-35176, CVE-2024-39908, CVE-2024-41123)\n\nIt was discovered that Ruby incorrectly handled parsing of an XML document\nthat has many entity expansions with SAX2 or pull parser API. An attacker\ncould use this issue to cause Ruby to crash, resulting in a denial of\nservice. (CVE-2024-41946)\n\nIt was discovered that Ruby incorrectly handled parsing of an XML document\nthat has many digits in a hex numeric character reference. An attacker\ncould use this issue to cause Ruby to crash, resulting in a denial of\nservice. (CVE-2024-49761)\n","status":"published","published":"2024-11-05T03:39:06Z","modified":"2026-04-27T17:47:19.113745569Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7091-2","title":"ruby2.7 vulnerabilities","description":"USN-7091-1 fixed several vulnerabilities in Ruby. This update provides the\ncorresponding update for CVE-2024-35176, CVE-2024-41123, CVE-2024-41946 and \nCVE-2024-49761 for ruby2.7 in Ubuntu 20.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that Ruby incorrectly handled parsing of an XML document\n that has specific XML characters in an attribute value using REXML gem. An\n attacker could use this issue to cause Ruby to crash, resulting in a\n denial of service. This issue only affected in Ubuntu 22.04 LTS and Ubuntu\n 24.04 LTS. (CVE-2024-35176, CVE-2024-39908, CVE-2024-41123)\n \n It was discovered that Ruby incorrectly handled parsing of an XML document\n that has many entity expansions with SAX2 or pull parser API. An attacker\n could use this issue to cause Ruby to crash, resulting in a denial of\n service. (CVE-2024-41946)\n \n It was discovered that Ruby incorrectly handled parsing of an XML document\n that has many digits in a hex numeric character reference. An attacker\n could use this issue to cause Ruby to crash, resulting in a denial of\n service. (CVE-2024-49761)\n","status":"published","published":"2024-11-21T03:39:20Z","modified":"2026-04-27T17:47:19.579451835Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7418-1","title":"ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerabilities","description":"It was discovered that Ruby incorrectly handled parsing of an XML document\nthat has specific XML characters in an attribute value using REXML gem. An\nattacker could use this issue to cause Ruby to crash, resulting in a\ndenial of service. This issue only affected in Ubuntu 22.04 LTS, Ubuntu\n24.04 LTS, and Ubuntu 24.10. (CVE-2024-35176, CVE-2024-39908,\nCVE-2024-41123, CVE-2024-43398)\n\nIt was discovered that Ruby incorrectly handled expanding ranges in the\nnet-imap response parser. If a user or automated system were tricked into\nconnecting to a malicious IMAP server, a remote attacker could possibly use\nthis issue to consume memory, leading to a denial of service. This issue\nonly affected Ubuntu 24.04 LTS, and Ubuntu 24.10. (CVE-2025-25186)\n\nIt was discovered that the Ruby CGI gem incorrectly handled parsing certain\ncookies. A remote attacker could possibly use this issue to consume\nresources, leading to a denial of service. (CVE-2025-27219)\n\nIt was discovered that the Ruby CGI gem incorrectly handled parsing certain\nregular expressions. A remote attacker could possibly use this issue to\nconsume resources, leading to a denial of service. (CVE-2025-27220)\n\nIt was discovered that the Ruby URI gem incorrectly handled certain URI\nhandling methods. A remote attacker could possibly use this issue to leak\nauthentication credentials. (CVE-2025-27221)\n","status":"published","published":"2025-04-07T13:55:18Z","modified":"2026-04-27T18:02:26.605127452Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-7734-1","title":"ruby2.5, ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerabilities","description":"It was discovered that Ruby incorrectly handled certain IO stream\nmethods. A remote attacker could use this issue to cause Ruby to crash,\nresulting in a denial of service, or possibly obtain sensitive\ninformation. This issue only affected Ubuntu 18.04 LTS. (CVE-2024-27280)\n\nIt was discovered that the Ruby regex compiler incorrectly handled\ncertain memory operations. A remote attacker could possibly use this\nissue to obtain sensitive memory contents. This issue only affected\nUbuntu 18.04 LTS. (CVE-2024-27282)\n\nIt was discovered that Ruby incorrectly handled parsing of certain XML\ncharacters through the REXML gem. An attacker could use this issue to\ncause Ruby to crash, resulting in a denial of service. This issue only\naffected Ubuntu 18.04 LTS. (CVE-2024-35176)\n\nIt was discovered that Ruby incorrectly handled decompressed domain names\nwithin a DNS packet. An attacker could use this issue to cause Ruby to\ncrash, resulting in a denial of service. (CVE-2025-24294)","status":"published","published":"2025-09-03T12:40:42Z","modified":"2026-04-27T18:16:24.911035Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-7840-1","title":"ruby2.3, ruby2.5, ruby2.7 vulnerabilities","description":"It was discovered that the REXML module bunded into Ruby incorrectly\nhandled parsing XML documents with repeated instances of certain\ncharacters. An attacker could possibly use this issue to cause REXML to\nconsume excessive resources, leading to a denial of service. Ubuntu 18.04\nLTS and Ubuntu 20.04 LTS were previously addressed in USN-7256-1 and\nUSN-7734-1. This update addresses the issue in Ubuntu 16.04 LTS.\n(CVE-2024-35176)\n\nIt was discovered that the REXML module bunded into Ruby incorrectly\nhandled parsing XML documents with repeated instances of certain\ncharacters. An attacker could possibly use this issue to cause REXML to\nconsume excessive resources, leading to a denial of service. Ubuntu 20.04\nLTS was previously addressed in USN-7256-1. This update addresses the issue\nin Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-39908, CVE-2024-41123)\n\nIt was discovered that the REXML module bunded into Ruby incorrectly\nhandled parsing XML documents with many entity expansions. An attacker\ncould possibly use this issue to cause REXML to consume excessive\nresources, leading to a denial of service. Ubuntu 20.04 LTS was previously\naddressed in USN-7091-2. This update addresses the issue in Ubuntu 16.04\nLTS and Ubuntu 18.04 LTS. (CVE-2024-41946)\n\nIt was discovered that the WEBrick module bundled into Ruby incorrectly\nhandled having both a Content-Length header and a Transfer-Encoding header.\nA remote attacker could possibly use this issue to perform a HTTP request\nsmuggling attack. (CVE-2024-47220)\n\nIt was discovered that the WEBrick module bundled into Ruby incorrectly\nparsed HTTP headers. In configurations where the WEBrick module is placed\nbehind an HTTP proxy, a remote attacker could possibly use this issue to\nperform an HTTP Request Smuggling attack. (CVE-2025-6442)","status":"published","published":"2025-10-27T14:39:58Z","modified":"2026-06-25T13:32:31.255143493Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}