CVE-2025-58767: 
Ruby vulnerability analysis and mitigation

REXML, an XML toolkit for Ruby, has been found to contain a Denial of Service (DoS) vulnerability (CVE-2025-58767) affecting versions 3.3.3 to 3.4.1. The vulnerability was discovered and disclosed on September 17, 2025, and it specifically impacts the XML parsing functionality when handling multiple XML declarations (GitHub Advisory).

The vulnerability exists in REXML's XML parsing mechanism when processing XML files containing multiple XML declarations. The issue has been assigned a CVSS v4.0 score of 1.2 (LOW) with the vector string CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) (NVD).

When exploited, this vulnerability can lead to a Denial of Service condition when parsing untrusted XML files containing malformed XML declarations. The impact is primarily on applications that process untrusted XML input using affected versions of the REXML gem (GitHub Advisory).

The primary mitigation is to upgrade to REXML version 3.4.2 or later, which includes patches to fix these vulnerabilities. As a temporary workaround, users are advised not to parse untrusted XML files. The fix includes implementation of XML declaration checks and improvements to the Source#skip_spaces method (GitHub Commit).