CVE-2025-58767: Ruby-lang Rexml DoS Vulnerability

CVE-2025-58767 Overview

CVE-2025-58767 is a denial of service (DoS) vulnerability in REXML, an XML toolkit shipped as a Ruby gem. The flaw affects REXML versions 3.3.3 through 3.4.1 and is triggered when the parser processes XML documents containing multiple XML declarations. Applications that parse untrusted XML using REXML can be forced into excessive resource consumption. The maintainers released REXML 3.4.2 to address the issue. The weakness is classified under CWE-400: Uncontrolled Resource Consumption.

Critical Impact
Local attackers supplying crafted XML to Ruby applications that use REXML can cause resource exhaustion and degrade availability of the parsing process.

Affected Products

Ruby REXML gem version 3.3.3
Ruby REXML gem versions up to and including 3.4.1
Ruby applications depending on the vulnerable REXML range for untrusted XML parsing

Discovery Timeline

2025-09-17 - CVE-2025-58767 published to the National Vulnerability Database (NVD)
2025-09-30 - Last updated in NVD database

Technical Details for CVE-2025-58767

Vulnerability Analysis

The vulnerability resides in REXML's source handling logic in lib/rexml/source.rb. When the parser encounters XML input that contains more than one XML declaration, the scanner does not terminate processing on the trailing ?> sequence as expected. This causes inefficient scanning behavior and uncontrolled resource consumption while parsing the document. Applications that pass attacker-controlled XML into REXML's parser inherit this DoS exposure. Because the attack vector is local and the impact is limited to availability, the impact remains contained to the parsing process and its host.

Root Cause

The root cause is incomplete handling of XML declaration terminators in REXML's predefined term patterns. The pre-defined terms used by the StringScanner did not include the ?> sequence, so the scanner could not efficiently detect declaration boundaries when multiple declarations were present. This is an uncontrolled resource consumption defect [CWE-400] rather than a memory safety issue.

Attack Vector

An attacker supplies an XML document containing multiple <?xml ... ?> declarations to any Ruby application that parses untrusted XML with the vulnerable REXML gem. Parsing the malformed input forces the scanner into excessive work, exhausting CPU or memory and degrading service availability for the parsing process.

ruby

     attr_reader :encoding
 
     module Private
+      SPACES_PATTERN = /\s+/um
       SCANNER_RESET_SIZE = 100000
       PRE_DEFINED_TERM_PATTERNS = {}
-      pre_defined_terms = ["'", '"', "<", "]]>"]
+      pre_defined_terms = ["'", '"', "<", "]]>", "?>"]
       if StringScanner::Version < "3.1.1"
         pre_defined_terms.each do |term|
           PRE_DEFINED_TERM_PATTERNS[term] = /#{Regexp.escape(term)}/
# Source: https://github.com/ruby/rexml/commit/5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23
# The patch adds "?>" to the predefined term patterns and introduces a Source#skip_spaces helper,
# allowing the scanner to correctly terminate at XML declaration boundaries.

Detection Methods for CVE-2025-58767

Indicators of Compromise

Ruby processes hosting REXML parsers consuming sustained high CPU while processing XML inputs.
Application logs showing slow or hung XML parsing operations originating from REXML::Parsers call stacks.
Inbound XML payloads containing multiple <?xml ... ?> declarations submitted to endpoints that invoke REXML.

Detection Strategies

Inventory Ruby application dependencies and flag any project whose Gemfile.lock pins rexml between 3.3.3 and 3.4.1.
Add static dependency scanning to CI pipelines using tools that consume the GitHub Security Advisory GHSA-c2f4-jgmc-q2r5.
Inspect web application firewall (WAF) and reverse proxy logs for XML bodies that contain repeated XML declaration tokens.

Monitoring Recommendations

Track CPU and memory utilization of Ruby workers handling XML, and alert on sustained spikes correlated with XML request payloads.
Emit timing metrics around REXML parse calls and alert when parse durations exceed an established baseline.
Monitor application error rates for parser timeouts and worker restarts following XML ingestion.

How to Mitigate CVE-2025-58767

Immediate Actions Required

Upgrade the rexml gem to version 3.4.2 or later in all affected Ruby applications.
Audit production services that accept XML from untrusted sources and prioritize them for patching.
Apply request size limits and parse timeouts on endpoints that accept XML payloads.

Patch Information

The maintainers fixed the issue in REXML 3.4.2. The upstream patch in ruby/rexml commit 5859bde adds ?> to the scanner's predefined terminator patterns and introduces a Source#skip_spaces helper, enabling the parser to correctly bound XML declarations. Coordination details are available in the GitHub Security Advisory GHSA-c2f4-jgmc-q2r5.

Workarounds

Reject XML inputs that contain more than one XML declaration before passing data to REXML.
Enforce a hard timeout around REXML parse operations to bound resource consumption.
Where feasible, replace REXML with an alternative XML parser for untrusted input until the upgrade is deployed.

bash

# Upgrade the vulnerable gem
bundle update rexml --conservative

# Verify the installed version is 3.4.2 or later
bundle exec gem list rexml

# Optional: pin a safe minimum in the Gemfile
# gem "rexml", ">= 3.4.2"