{"action":"Upgrade rexml to 3.4.2 or later.","affected":[{"fixed":"3.4.2","introduced":"3.3.3"}],"component":"rexml","cve_ids":["CVE-2025-58767"],"ecosystem":"RubyGems","epss":0.0025,"exploited":false,"fixed_versions":["3.4.2"],"ghsa_id":"GHSA-c2f4-jgmc-q2r5","id":"tcs_01M5KEJK2ZMR6PH034656G8Q0G","modified_at":"2026-09-10T03:50:28.180264811Z","published_at":"2025-09-17T18:26:48Z","references":["https://osv.dev/vulnerability/GHSA-c2f4-jgmc-q2r5","https://github.com/ruby/rexml/security/advisories/GHSA-c2f4-jgmc-q2r5","https://nvd.nist.gov/vuln/detail/CVE-2025-58767","https://github.com/ruby/rexml/commit/5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23","https://github.com/ruby/rexml","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2025-58767.yml","https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-c2f4-jgmc-q2r5","url":"https://osv.dev/vulnerability/GHSA-c2f4-jgmc-q2r5"},{"source":"nvd","source_id":"CVE-2025-58767","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58767"}],"summary":"REXML has DoS condition when parsing malformed XML file"}