CVE-2025-58767: REXML has a DoS condition when parsing malformed XML file
Impact
The REXML gems from 3.3.3 to 3.4.1 have a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.
Patches
REXML gems 3.4.2 or later include the patches to fix these vulnerabilities.
Workarounds
Don't parse untrusted XMLs.
References
https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/ : An announcement on www.ruby-lang.org
Other sources
REXML has a DoS condition when parsing malformed XML file
— Microsoft
REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58767?
CVE-2025-58767 is classified as a Denial of Service (DoS) vulnerability that can impact applications parsing untrusted XML.
How do I fix CVE-2025-58767?
To mitigate CVE-2025-58767, upgrade Ruby REXML to version 3.4.2 or later, which includes the necessary patches.
Who is affected by CVE-2025-58767?
Applications using Ruby REXML version 3.3.3 to 3.4.1 are vulnerable to CVE-2025-58767.
What type of vulnerability is CVE-2025-58767?
CVE-2025-58767 is a Denial of Service vulnerability that occurs when parsing XML with multiple XML declarations.
Can CVE-2025-58767 be exploited by untrusted sources?
Yes, CVE-2025-58767 can be exploited when parsing untrusted XML files containing multiple declarations.