Description
The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | ruby1.8 | 1.8.5-4etch3 | DSA-1651-1 |
| Debian 4.0 | ruby1.9 | 1.9.0+20060609-1etch3 | DSA-1652-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | ruby +8 | 1.8.5-5.el5_2.5 | RHSA-2008:0897 |
| RHEL 4 | irb +6 | 1.8.1-7.el4_7.1 | RHSA-2008:0897 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Ruby 1.9 - REXML Remote Denial of Service EDB-32292 · dos · Aug 23, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2008:0897 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1652-1 ruby1.9 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1651-1 ruby1.8 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-651-1 vendor-advisory
- 33185 third-party-advisory
- oval:org.mitre.oval:def:10393 vdb-entry signature
- http://support.apple.com/kb/HT3549
- http://www.ruby-lang.org/security/20080823rexml/rexml-expansion-fix.rb
- 1020735 vdb-entry
- DSA-1652 vendor-advisory
- FEDORA-2008-8736 vendor-advisory
- ADV-2008-2428 vdb-entry
- ruby-rexml-dos(44628) vdb-entry
- 35074 third-party-advisory
- [oss-security] 20080826 Re: CVE Request (ruby) mailing-list
- http://weblog.rubyonrails.org/2008/9/3/rails-2-0-4-maintenance-release
- http://support.avaya.com/elmodocs2/security/ASA-2008-424.htm
- DSA-1651 vendor-advisory
- APPLE-SA-2009-05-12 vendor-advisory
- http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/
- RHSA-2008:0897 vendor-advisory
- http://groups.google.com/group/comp.lang.ruby/browse_thread/thread/19f69e8a081fc0d1/e138e014b74352ca
- [oss-security] 20080825 CVE Request (ruby) mailing-list
- 32219 third-party-advisory
- TA09-133A third-party-advisory
- 32255 third-party-advisory
- ADV-2009-1297 vdb-entry
- 30802 vdb-entry
- USN-691-1 vendor-advisory
- [oss-security] 20080826 Re: CVE Request (ruby) mailing-list
- 32371 third-party-advisory
- 32165 third-party-advisory
- GLSA-200812-17 vendor-advisory
- 33178 third-party-advisory
- FEDORA-2008-8738 vendor-advisory
- 32256 third-party-advisory
- 31602 third-party-advisory
- ADV-2008-2483 vdb-entry