CVE-2025-58767: 
Ruby vulnerability analysis and mitigation

REXML, an XML toolkit for Ruby, was found to contain a Denial of Service (DoS) vulnerability in versions 3.3.3 to 3.4.1. The vulnerability was discovered and disclosed on September 17, 2025, and was assigned CVE-2025-58767. The vulnerability affects the XML parsing functionality when handling multiple XML declarations (NVD, GitHub Advisory).

The vulnerability exists in the XML parsing mechanism when handling XML declarations. The issue specifically occurs when parsing XML files containing multiple XML declarations, which can lead to a Denial of Service condition. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) (NVD).

The primary impact of this vulnerability is the potential for Denial of Service attacks when parsing untrusted XML files. When exploited, the vulnerability can affect the availability of applications using the REXML gem to parse XML content (GitHub Advisory).

The vulnerability has been patched in REXML version 3.4.2. Users are advised to upgrade to this version or later to address the vulnerability. As a temporary workaround, users should avoid parsing untrusted XML content if immediate upgrading is not possible (GitHub Advisory).