Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apk/alpine/ruby-rexml@3.3.9-r0?arch=ppc64le&distroversion=v3.20&reponame=main
purl pkg:apk/alpine/ruby-rexml@3.3.9-r0?arch=ppc64le&distroversion=v3.20&reponame=main
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (3)
Vulnerability Summary Aliases
VCID-72eq-rdjr-pba4 REXML denial of service vulnerability ### Impact The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like `REXML::Document.new`, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. ### Patches The REXML gem 3.3.6 or later include the patch to fix the vulnerability. ### Workarounds Don't parse untrusted XMLs with tree parser API. ### References * https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398/ : An announce on www.ruby-lang.org CVE-2024-43398
GHSA-vmwr-mc7x-5vc3
VCID-jpyj-txnh-2ueg REXML ReDoS vulnerability ### Impact The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between `&#` and `x...;` in a hex numeric character reference (`&#x...;`). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03. ### Patches The REXML gem 3.3.9 or later include the patch to fix the vulnerability. ### Workarounds Use Ruby 3.2 or later instead of Ruby 3.1. ### References * https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org CVE-2024-49761
GHSA-2rxp-v6pw-ch6m
VCID-w2b1-y1qp-1qag REXML denial of service vulnerability ### Impact The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. ### Patches The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. ### Workarounds Don't parse untrusted XMLs. ### References * https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh : This is a similar vulnerability * https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908/ CVE-2024-39908
GHSA-4xqq-m2hx-25v8

Date Actor Action Vulnerability Source VulnerableCode Version
2026-05-29T10:06:52.868535+00:00 Alpine Linux Importer Fixing VCID-w2b1-y1qp-1qag https://secdb.alpinelinux.org/v3.20/main.json 38.6.0
2026-05-29T09:46:24.729374+00:00 Alpine Linux Importer Fixing VCID-72eq-rdjr-pba4 https://secdb.alpinelinux.org/v3.20/main.json 38.6.0
2026-05-29T09:42:03.106787+00:00 Alpine Linux Importer Fixing VCID-jpyj-txnh-2ueg https://secdb.alpinelinux.org/v3.20/main.json 38.6.0