CVE-2025-58767
Last modified
CVE-2025-58767 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ruby-Lang | Rexml | >= 3.3.3, < 3.4.2 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-58767?
How severe is CVE-2025-58767?
How do I fix CVE-2025-58767?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-58761Tautulli is a Python based monitoring and tracking tool for …7.5
- CVE-2025-58762Tautulli is a Python based monitoring and tracking tool for …7.2
- CVE-2025-58763Tautulli is a Python based monitoring and tracking tool for …7.2
- CVE-2025-58764Claude Code is an agentic coding tool. Due to an error in co…9.8
- CVE-2025-58765wabac.js provides a full web archive replay system, or 'wayb…7.1
- CVE-2025-58766Dyad is a local AI app builder. A critical security vulnerab…9
- CVE-2025-58768DeepChat is a smart assistant uses artificial intelligence. …9.6
- CVE-2025-58769auth0-PHP is an SDK for Auth0 Authentication and Management …3.3
- CVE-2025-5877A vulnerability, which was classified as problematic, has be…8.1
- CVE-2025-58770APTIOV contains a vulnerability in BIOS where a user may cau…8.8
- CVE-2025-58775KV STUDIO and VT5-WX15/WX12 contain a stack-based buffer ove…8.4
- CVE-2025-58776KV Studio versions 12.23 and prior contain a stack-based buf…8.4
Are you affected by CVE-2025-58767?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST