The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1…
Priority MEDIUM 41CWE-115Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 8 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
Why it matters now
EPSS 0.05061 92nd percentileScored 2026-11-07
Fix Partial rexml (RubyGems): 3.2.5Red Hat: 11 advisoriesRed Hat: 8 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | rexml (RubyGems) | before 3.2.5 | 3.2.5 | Patch available | GHSA-8cr8-4vfw-mr7h |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- rexml (RubyGems) Vendor— Affected before 3.2.5 Fixed in 3.2.5 Patch available GHSA-8cr8-4vfw-mr7h
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:* | before 3.2.5 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* | before 2.6.7; 2.7.0 to before 2.7.3; 3.0.0 to before 3.0.1 | Vulnerable | ruby |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
- cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:* Versions before 3.2.5 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* Versions before 2.6.7; 2.7.0 to before 2.7.3; 3.0.0 to before 3.0.1 Vulnerable ·ruby
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-8cr8-4vfw-mr7h rexml (RubyGems) Fixed in 3.2.5 Advisory →
Red Hat 11 advisories
- RHSA-2026:8838 Released 2026-04-17 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images ruby4.0-4.0.0-33.3.hum1@aarch64, ruby4.0-4.0.0-33.3.hum1@src, ruby4.0-4.0.0-33.3.hum1@x86_64 +10
- RHSA-2026:7307 Released 2026-04-09 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images ruby3.4-3.4.8-31.1.hum1@aarch64, ruby3.4-3.4.8-31.1.hum1@src, ruby3.4-3.4.8-31.1.hum1@x86_64 +10
- RHSA-2026:7305 Released 2026-04-09 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images ruby3.3-3.3.10-23.1.hum1@aarch64, ruby3.3-3.3.10-23.1.hum1@src, ruby3.3-3.3.10-23.1.hum1@x86_64 +10
Show 8 more Red Hat advisories
- RHSA-2022:0582 Released 2022-02-21 · Red Hat rating Importantruby:2.6 security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) ruby-2.6.9-107.module+el8.2.0+14086+86d863af.aarch64::ruby:2.6, ruby-2.6.9-107.module+el8.2.0+14086+86d863af.i686::ruby:2.6, ruby-2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le::ruby:2.6 +47
- RHSA-2022:0581 Released 2022-02-21 · Red Hat rating Importantruby:2.6 security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.1) ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.i686::ruby:2.6, ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.ppc64le::ruby:2.6, ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.src::ruby:2.6 +47
- RHSA-2021:2587 Released 2021-06-29 · Red Hat rating Moderateruby:2.5 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) ruby-2.5.9-107.module+el8.4.0+10822+fe4fffb1.aarch64::ruby:2.5, ruby-2.5.9-107.module+el8.4.0+10822+fe4fffb1.i686::ruby:2.5, ruby-2.5.9-107.module+el8.4.0+10822+fe4fffb1.ppc64le::ruby:2.5 +47
- RHSA-2021:2584 Released 2021-06-29 · Red Hat rating Moderateruby:2.7 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) ruby-2.7.3-136.module+el8.4.0+10728+4c884998.aarch64::ruby:2.7, ruby-2.7.3-136.module+el8.4.0+10728+4c884998.i686::ruby:2.7, ruby-2.7.3-136.module+el8.4.0+10728+4c884998.ppc64le::ruby:2.7 +47
- RHSA-2021:2588 Released 2021-06-29 · Red Hat rating Moderateruby:2.6 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) ruby-2.6.7-107.module+el8.4.0+10830+bbd85cce.aarch64::ruby:2.6, ruby-2.6.7-107.module+el8.4.0+10830+bbd85cce.i686::ruby:2.6, ruby-2.6.7-107.module+el8.4.0+10830+bbd85cce.ppc64le::ruby:2.6 +47
- RHSA-2021:2229 Released 2021-06-03 · Red Hat rating Moderaterh-ruby27-ruby security, bug fix, and enhancement update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ruby27-ruby-2.7.3-129.el7, rh-ruby27-ruby-devel-2.7.3-129.el7, rh-ruby27-ruby-doc-2.7.3-129.el7 +19
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-ruby27-ruby-2.7.3-129.el7, rh-ruby27-ruby-devel-2.7.3-129.el7, rh-ruby27-ruby-doc-2.7.3-129.el7 +19
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ruby27-ruby-2.7.3-129.el7, rh-ruby27-ruby-devel-2.7.3-129.el7, rh-ruby27-ruby-doc-2.7.3-129.el7 +19
- RHSA-2021:2230 Released 2021-06-03 · Red Hat rating Moderaterh-ruby26-ruby security, bug fix, and enhancement update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ruby26-ruby-2.6.7-119.el7, rh-ruby26-ruby-devel-2.6.7-119.el7, rh-ruby26-ruby-doc-2.6.7-119.el7 +18
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-ruby26-ruby-2.6.7-119.el7, rh-ruby26-ruby-devel-2.6.7-119.el7, rh-ruby26-ruby-doc-2.6.7-119.el7 +18
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ruby26-ruby-2.6.7-119.el7, rh-ruby26-ruby-devel-2.6.7-119.el7, rh-ruby26-ruby-doc-2.6.7-119.el7 +18
- RHSA-2021:2104 Released 2021-05-26 · Red Hat rating Moderaterh-ruby25-ruby security, bug fix, and enhancement update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ruby25-ruby-2.5.9-9.el7, rh-ruby25-ruby-devel-2.5.9-9.el7, rh-ruby25-ruby-doc-2.5.9-9.el7 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-ruby25-ruby-2.5.9-9.el7, rh-ruby25-ruby-devel-2.5.9-9.el7, rh-ruby25-ruby-doc-2.5.9-9.el7 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-ruby25-ruby-2.5.9-9.el7, rh-ruby25-ruby-devel-2.5.9-9.el7, rh-ruby25-ruby-doc-2.5.9-9.el7 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ruby25-ruby-2.5.9-9.el7, rh-ruby25-ruby-devel-2.5.9-9.el7, rh-ruby25-ruby-doc-2.5.9-9.el7 +17
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Hardened Images | Affected | No fix yet |
| Red Hat Software Collections | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:2584, RHSA-2021:2587, RHSA-2021:2588 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.1) | Fixed | RHSA-2022:0581 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.2) | Fixed | RHSA-2022:0582 |
| Red Hat Hardened Images | Fixed | RHSA-2026:7305, RHSA-2026:7307, RHSA-2026:8838 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:2104, RHSA-2021:2229, RHSA-2021:2230 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2021:2104 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2021:2104, RHSA-2021:2229, RHSA-2021:2230 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:2104, RHSA-2021:2229, RHSA-2021:2230 |
Not affected: 3 products
- CloudForms Management Engine 5
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2021-28965
- 2026-10-03 Alias added: GHSA-8cr8-4vfw-mr7h
- 2026-11-07 Affected versions changed · Red Hat
References
Advisory 4
Other 14
- https://github.com/ruby/rexml/commit/2fe62e29094d95921d7e19abbd2e26b23d78dc5b
- https://github.com/ruby/rexml/commit/3c137eb119550874b2b3e27d12b733ca67033377
- https://github.com/ruby/rexml/commit/6a250d2cd1194c2be72becbdd9c3e770aa16e752
- https://github.com/ruby/rexml/commit/9b311e59ae05749e082eb6bbefa1cb620d1a786e
- https://github.com/ruby/rexml/commit/a659c63e37414506dfb0d4655e031bb7a2e73fc8
- https://github.com/ruby/rexml/commit/f7bab8937513b1403cea5aff874cbf32fd5e8551
- https://github.com/ruby/rexml/commit/f9d88e4948b4a43294c25dc0edb16815bd9d8618
- https://hackerone.com/reports/1104077
- https://github.com/ruby/rexml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2021-28965.yml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT
- https://rubygems.org/gems/rexml
- https://security.netapp.com/advisory/ntap-20210528-0003
- https://www.ruby-lang.org/en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965
Sources
- CVE-2021-28965 · CVE Program
- CVE-2021-28965 · NVD
- FIRST EPSS
- GHSA-8cr8-4vfw-mr7h · GitHub Advisory Database · CC BY 4.0
- CVE-2021-28965 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences