lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers…
Priority LOW 33CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Partial Red Hat: 13 fixed, 3 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.
Why it matters now
EPSS 0.06857 94th percentileScored 2026-11-07
Fix Partial org.jruby:jruby (Maven): 1.7.3Red Hat: 8 advisoriesRed Hat: 13 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.jruby:jruby (Maven) | before 1.7.3 | 1.7.3 | Patch available | GHSA-hgg7-cghq-xhf4 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.jruby:jruby (Maven) Vendor— Affected before 1.7.3 Fixed in 1.7.3 Patch available GHSA-hgg7-cghq-xhf4
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ruby-lang:ruby:*:p385:*:*:*:*:*:* | up to 1.9.3 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:* | 1.9 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:* | 1.9.1 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:* | 1.9.2 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:* | 1.9.3 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:* | 1.9.3 p0 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:* | 1.9.3 p125 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:* | 1.9.3 p194 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:* | 1.9.3 p286 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:* | 1.9.3 p383 | Vulnerable | ruby |
- cpe:2.3:a:ruby-lang:ruby:*:p385:*:*:*:*:*:* Versions up to 1.9.3 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:* Versions 1.9.3 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:* Versions 1.9.3 p0 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:* Versions 1.9.3 p125 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:* Versions 1.9.3 p194 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:* Versions 1.9.3 p286 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:* Versions 1.9.3 p383 Vulnerable ·ruby
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:* | 2.0.0 rc1 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:* | 2.0.0 rc2 | Vulnerable | ruby |
- cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·ruby
Remediation
- Fix · GHSA-hgg7-cghq-xhf4 org.jruby:jruby (Maven) Fixed in 1.7.3 Advisory →
Red Hat 8 advisories
- RHSA-2026:8838 Released 2026-04-17 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images ruby4.0-4.0.0-33.3.hum1@aarch64, ruby4.0-4.0.0-33.3.hum1@src, ruby4.0-4.0.0-33.3.hum1@x86_64 +10
- RHSA-2026:7307 Released 2026-04-09 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images ruby3.4-3.4.8-31.1.hum1@aarch64, ruby3.4-3.4.8-31.1.hum1@src, ruby3.4-3.4.8-31.1.hum1@x86_64 +10
- RHSA-2026:7305 Released 2026-04-09 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images ruby3.3-3.3.10-23.1.hum1@aarch64, ruby3.3-3.3.10-23.1.hum1@src, ruby3.3-3.3.10-23.1.hum1@x86_64 +10
Show 5 more Red Hat advisories
- RHSA-2013:1185 Released 2013-08-29 · Red Hat rating ImportantRed Hat JBoss Fuse 6.0.0 patch 2
- Red Hat JBoss Fuse 6.0
- RHSA-2013:1147 Released 2013-08-08 · Red Hat rating ModerateRed Hat JBoss SOA Platform 5.3.1 update
- Red Hat JBoss SOA Platform 5.3
- RHSA-2013:1028 Released 2013-07-09 · Red Hat rating ImportantFuse ESB Enterprise 7.1.0 update
- Fuse ESB Enterprise 7.1.0
- RHSA-2013:0612 Released 2013-03-07 · Red Hat rating Moderateruby security update
- Red Hat Enterprise Linux Desktop (v. 6) ruby-1.8.7.352-10.el6_4, ruby-devel-1.8.7.352-10.el6_4, ruby-irb-1.8.7.352-10.el6_4 +2
- Red Hat Enterprise Linux Desktop Optional (v. 6) ruby-1.8.7.352-10.el6_4, ruby-docs-1.8.7.352-10.el6_4, ruby-ri-1.8.7.352-10.el6_4 +2
- Red Hat Enterprise Linux HPC Node (v. 6) ruby-1.8.7.352-10.el6_4, ruby-devel-1.8.7.352-10.el6_4, ruby-irb-1.8.7.352-10.el6_4 +2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) ruby-1.8.7.352-10.el6_4, ruby-docs-1.8.7.352-10.el6_4, ruby-ri-1.8.7.352-10.el6_4 +2
- Red Hat Enterprise Linux Server (v. 6) ruby-1.8.7.352-10.el6_4, ruby-devel-1.8.7.352-10.el6_4, ruby-devel-1.8.7.352-10.el6_4.ppc +4
- Red Hat Enterprise Linux Server Optional (v. 6) ruby-1.8.7.352-10.el6_4, ruby-docs-1.8.7.352-10.el6_4, ruby-ri-1.8.7.352-10.el6_4 +2
- Red Hat Enterprise Linux Workstation (v. 6) ruby-1.8.7.352-10.el6_4, ruby-devel-1.8.7.352-10.el6_4, ruby-irb-1.8.7.352-10.el6_4 +2
- Red Hat Enterprise Linux Workstation Optional (v. 6) ruby-1.8.7.352-10.el6_4, ruby-docs-1.8.7.352-10.el6_4, ruby-ri-1.8.7.352-10.el6_4 +2
- RHSA-2013:0611 Released 2013-03-07 · Red Hat rating Moderateruby security update
- Red Hat Enterprise Linux (v. 5 server) ruby-1.8.5-29.el5_9, ruby-1.8.5-29.el5_9.i386, ruby-1.8.5-29.el5_9.ia64 +33
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Enterprise 1 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat JBoss SOA Platform 5 | Affected | No fix yet |
| Fuse ESB Enterprise 7.1.0 | Fixed | RHSA-2013:1028 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2013:0611 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2013:0612 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2013:0612 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2013:0612 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2013:0612 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2013:0612 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2013:0612 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2013:0612 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2013:0612 |
| Red Hat Hardened Images | Fixed | RHSA-2026:7305, RHSA-2026:7307, RHSA-2026:8838 |
| Red Hat JBoss Fuse 6.0 | Fixed | RHSA-2013:1185 |
| Red Hat JBoss SOA Platform 5.3 | Fixed | RHSA-2013:1147 |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2013-1821
- 2026-10-03 Alias added: GHSA-hgg7-cghq-xhf4
- 2026-11-05 Affected versions changed · Red Hat
References
Advisory 15
Other 9
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=39384
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702525
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0092
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- [oss-security] 20130306 CVE for Ruby Entity expansion DoS vulnerability in REXML (XML bomb)
- https://bugzilla.redhat.com/show_bug.cgi?id=914716
- https://github.com/jruby/jruby
- https://www.jruby.org/2013/02/21/jruby-1-7-3.html
- http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22
More Ruby vulnerabilities
- TI-2026-71508 Integer overflow in GitLab allows code execution on the server KEVCVSS 3.1CRITICAL 10.0
- TI-2017-12709 Ruby before 2.4.3 allows Net::FTP command injection. CVSS 3.0HIGH 8.8
- TI-2008-03501 Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value… CVSS 2.0HIGH 7.8
- TI-2021-09891 In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web… CVSS 3.1HIGH 7.5
- TI-2013-03637 Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1… CVSS 2.0MEDIUM 6.8
- TI-2018-11751 An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2013-1821 · CVE Program
- CVE-2013-1821 · NVD
- FIRST EPSS
- GHSA-hgg7-cghq-xhf4 · GitHub Advisory Database · CC BY 4.0
- CVE-2013-1821 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences