Read the docs
TI-2014-06697 Aliases CVE-2014-8080GHSA-ggvr-v7qh-jwjh

The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x…

Priority LOW 31Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
Partial Red Hat: 24 fixed, 8 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.

Why it matters now

EPSS 0.05645 93rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 7 advisoriesRed Hat: 24 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 31

CPEVersionsRoleVendor
cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*12.3VulnerableopenSUSE
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*13.1VulnerableopenSUSE
cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*14.10VulnerableCanonical
cpe:2.3:a:ruby-lang:ruby:*:p550:*:*:*:*:*:*up to 1.9.3Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*1.9.3Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:*1.9.3 p0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:*1.9.3 p125Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:*1.9.3 p194Vulnerableruby
  • cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:* Versions 12.3 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* Versions 13.1 Vulnerable ·openSUSE
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:* Versions 14.10 Vulnerable ·Canonical
  • cpe:2.3:a:ruby-lang:ruby:*:p550:*:*:*:*:*:* Versions up to 1.9.3 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:* Versions 1.9.3 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:* Versions 1.9.3 p0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:* Versions 1.9.3 p125 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:* Versions 1.9.3 p194 Vulnerable ·ruby
Show 21 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:*1.9.3 p286Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:*1.9.3 p383Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:p385:*:*:*:*:*:*1.9.3 p385Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:p392:*:*:*:*:*:*1.9.3 p392Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:p426:*:*:*:*:*:*1.9.3 p426Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:p429:*:*:*:*:*:*1.9.3 p429Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:p448:*:*:*:*:*:*1.9.3 p448Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:p545:*:*:*:*:*:*1.9.3 p545Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.3:p547:*:*:*:*:*:*1.9.3 p547Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*2.0.0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:*2.0.0 p0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:*:*:*:*:*:*2.0.0 p195Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:*:*:*:*:*:*2.0.0 p247Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:p451:*:*:*:*:*:*2.0.0 p451Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:p481:*:*:*:*:*:*2.0.0 p481Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:p576:*:*:*:*:*:*2.0.0 p576Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.1.1:*:*:*:*:*:*:*2.1.1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.1.2:*:*:*:*:*:*:*2.1.2Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.1.3:*:*:*:*:*:*:*2.1.3Vulnerableruby
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:* Versions 1.9.3 p286 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:* Versions 1.9.3 p383 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p385:*:*:*:*:*:* Versions 1.9.3 p385 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p392:*:*:*:*:*:* Versions 1.9.3 p392 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p426:*:*:*:*:*:* Versions 1.9.3 p426 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p429:*:*:*:*:*:* Versions 1.9.3 p429 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p448:*:*:*:*:*:* Versions 1.9.3 p448 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p545:*:*:*:*:*:* Versions 1.9.3 p545 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p547:*:*:*:*:*:* Versions 1.9.3 p547 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:* Versions 2.0.0 p0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:*:*:*:*:*:* Versions 2.0.0 p195 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:*:*:*:*:*:* Versions 2.0.0 p247 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p451:*:*:*:*:*:* Versions 2.0.0 p451 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p481:*:*:*:*:*:* Versions 2.0.0 p481 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p576:*:*:*:*:*:* Versions 2.0.0 p576 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·ruby
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

Red Hat 7 advisories

  • RHSA-2026:8838 Released 2026-04-17 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby4.0-4.0.0-33.3.hum1@aarch64, ruby4.0-4.0.0-33.3.hum1@src, ruby4.0-4.0.0-33.3.hum1@x86_64 +10
  • RHSA-2026:7307 Released 2026-04-09 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby3.4-3.4.8-31.1.hum1@aarch64, ruby3.4-3.4.8-31.1.hum1@src, ruby3.4-3.4.8-31.1.hum1@x86_64 +10
  • RHSA-2026:7305 Released 2026-04-09 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby3.3-3.3.10-23.1.hum1@aarch64, ruby3.3-3.3.10-23.1.hum1@src, ruby3.3-3.3.10-23.1.hum1@x86_64 +10
Show 4 more Red Hat advisories
  • RHSA-2014:1912 Released 2014-11-26 · Red Hat rating Moderate
    ruby security update
    • Red Hat Enterprise Linux Client (v. 7) ruby-2.0.0.353-22.el7_0, ruby-irb-2.0.0.353-22.el7_0, ruby-libs-2.0.0.353-22.el7_0 +6
    • Red Hat Enterprise Linux Client Optional (v. 7) ruby-devel-2.0.0.353-22.el7_0, ruby-doc-2.0.0.353-22.el7_0, ruby-tcltk-2.0.0.353-22.el7_0 +3
    • Red Hat Enterprise Linux ComputeNode (v. 7) ruby-2.0.0.353-22.el7_0, ruby-irb-2.0.0.353-22.el7_0, ruby-libs-2.0.0.353-22.el7_0 +6
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) ruby-devel-2.0.0.353-22.el7_0, ruby-doc-2.0.0.353-22.el7_0, ruby-tcltk-2.0.0.353-22.el7_0 +3
    • Red Hat Enterprise Linux Server (v. 7) ruby-2.0.0.353-22.el7_0, ruby-irb-2.0.0.353-22.el7_0, ruby-libs-2.0.0.353-22.el7_0 +7
    • Red Hat Enterprise Linux Server Optional (v. 7) ruby-devel-2.0.0.353-22.el7_0, ruby-doc-2.0.0.353-22.el7_0, ruby-tcltk-2.0.0.353-22.el7_0 +3
    • Red Hat Enterprise Linux Workstation (v. 7) ruby-2.0.0.353-22.el7_0, ruby-irb-2.0.0.353-22.el7_0, ruby-libs-2.0.0.353-22.el7_0 +6
    • Red Hat Enterprise Linux Workstation Optional (v. 7) ruby-devel-2.0.0.353-22.el7_0, ruby-doc-2.0.0.353-22.el7_0, ruby-tcltk-2.0.0.353-22.el7_0 +3
  • RHSA-2014:1913 Released 2014-11-26 · Red Hat rating Moderate
    ruby193-ruby security update
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) ruby193-ruby-1.9.3.484-50.el6, ruby193-ruby-devel-1.9.3.484-50.el6, ruby193-ruby-doc-1.9.3.484-50.el6 +11
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) ruby193-ruby-1.9.3.484-50.el7, ruby193-ruby-devel-1.9.3.484-50.el7, ruby193-ruby-doc-1.9.3.484-50.el7 +11
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) ruby193-ruby-1.9.3.484-50.el6, ruby193-ruby-devel-1.9.3.484-50.el6, ruby193-ruby-doc-1.9.3.484-50.el6 +11
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5) ruby193-ruby-1.9.3.484-50.el6, ruby193-ruby-devel-1.9.3.484-50.el6, ruby193-ruby-doc-1.9.3.484-50.el6 +11
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.6) ruby193-ruby-1.9.3.484-50.el6, ruby193-ruby-devel-1.9.3.484-50.el6, ruby193-ruby-doc-1.9.3.484-50.el6 +11
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) ruby193-ruby-1.9.3.484-50.el6, ruby193-ruby-devel-1.9.3.484-50.el6, ruby193-ruby-doc-1.9.3.484-50.el6 +11
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) ruby193-ruby-1.9.3.484-50.el7, ruby193-ruby-devel-1.9.3.484-50.el7, ruby193-ruby-doc-1.9.3.484-50.el7 +11
  • RHSA-2014:1914 Released 2014-11-26 · Red Hat rating Moderate
    ruby200-ruby security update
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) ruby200-ruby-2.0.0.353-24.el6, ruby200-ruby-devel-2.0.0.353-24.el6, ruby200-ruby-doc-2.0.0.353-24.el6 +12
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) ruby200-ruby-2.0.0.353-24.el7, ruby200-ruby-devel-2.0.0.353-24.el7, ruby200-ruby-doc-2.0.0.353-24.el7 +12
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) ruby200-ruby-2.0.0.353-24.el6, ruby200-ruby-devel-2.0.0.353-24.el6, ruby200-ruby-doc-2.0.0.353-24.el6 +12
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5) ruby200-ruby-2.0.0.353-24.el6, ruby200-ruby-devel-2.0.0.353-24.el6, ruby200-ruby-doc-2.0.0.353-24.el6 +12
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.6) ruby200-ruby-2.0.0.353-24.el6, ruby200-ruby-devel-2.0.0.353-24.el6, ruby200-ruby-doc-2.0.0.353-24.el6 +12
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) ruby200-ruby-2.0.0.353-24.el6, ruby200-ruby-devel-2.0.0.353-24.el6, ruby200-ruby-doc-2.0.0.353-24.el6 +12
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) ruby200-ruby-2.0.0.353-24.el7, ruby200-ruby-devel-2.0.0.353-24.el7, ruby200-ruby-doc-2.0.0.353-24.el7 +12
  • RHSA-2014:1911 Released 2014-11-26 · Red Hat rating Moderate
    ruby security update
    • Red Hat Enterprise Linux Desktop (v. 6) ruby-1.8.7.374-3.el6_6, ruby-devel-1.8.7.374-3.el6_6, ruby-irb-1.8.7.374-3.el6_6 +2
    • Red Hat Enterprise Linux Desktop Optional (v. 6) ruby-docs-1.8.7.374-3.el6_6, ruby-ri-1.8.7.374-3.el6_6, ruby-static-1.8.7.374-3.el6_6 +1
    • Red Hat Enterprise Linux HPC Node (v. 6) ruby-1.8.7.374-3.el6_6, ruby-devel-1.8.7.374-3.el6_6, ruby-irb-1.8.7.374-3.el6_6 +2
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) ruby-docs-1.8.7.374-3.el6_6, ruby-ri-1.8.7.374-3.el6_6, ruby-static-1.8.7.374-3.el6_6 +1
    • Red Hat Enterprise Linux Server (v. 6) ruby-1.8.7.374-3.el6_6, ruby-devel-1.8.7.374-3.el6_6, ruby-devel-1.8.7.374-3.el6_6.ppc +4
    • Red Hat Enterprise Linux Server Optional (v. 6) ruby-docs-1.8.7.374-3.el6_6, ruby-ri-1.8.7.374-3.el6_6, ruby-static-1.8.7.374-3.el6_6 +1
    • Red Hat Enterprise Linux Workstation (v. 6) ruby-1.8.7.374-3.el6_6, ruby-devel-1.8.7.374-3.el6_6, ruby-irb-1.8.7.374-3.el6_6 +2
    • Red Hat Enterprise Linux Workstation Optional (v. 6) ruby-docs-1.8.7.374-3.el6_6, ruby-ri-1.8.7.374-3.el6_6, ruby-static-1.8.7.374-3.el6_6 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5AffectedNo fix planned: Will not fix
OpenShift Enterprise 1AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 4AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat JBoss SOA Platform 4AffectedNo fix planned: Will not fix
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 4AffectedNo fix planned: Will not fix
Red Hat Subscription Asset ManagerAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2014:1912
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2014:1912
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2014:1912
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2014:1912
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2014:1911
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2014:1911
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2014:1911
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2014:1911
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:1911
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2014:1912
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2014:1911
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2014:1912
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:1911
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2014:1912
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2014:1911
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2014:1912
Red Hat Hardened ImagesFixed RHSA-2026:7305, RHSA-2026:7307, RHSA-2026:8838
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:1913, RHSA-2014:1914
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2014:1913, RHSA-2014:1914
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4)Fixed RHSA-2014:1913, RHSA-2014:1914
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5)Fixed RHSA-2014:1913, RHSA-2014:1914
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.6)Fixed RHSA-2014:1913, RHSA-2014:1914
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:1913, RHSA-2014:1914
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2014:1913, RHSA-2014:1914
Not affected: 2 products
  • Red Hat Hardened Images
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-8080
  2. 2026-10-03 Alias added: GHSA-ggvr-v7qh-jwjh
  3. 2026-11-02 Affected versions changed · Red Hat

References

Exploit 1

Advisory 12

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences