N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-58767

CVE-2025-58767: REXML has DoS condition when parsing malformed XML file

Impact

The REXML gems from 3.3.3 to 3.4.1 have a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities.

Patches

REXML gems 3.4.2 or later include the patches to fix these vulnerabilities.

Workarounds

Don't parse untrusted XMLs.

References

https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/ : An announcement on www.ruby-lang.org

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-58767

CVE-2025-58767:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rexml	rubygems	>= 3.3.3, <= 3.4.1	3.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the parsing of XML files within the REXML gem, specifically related to handling multiple XML declarations, which can cause a Denial of Service. The analysis of the provided patch commit 5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23 points directly to the REXML::Parsers::BaseParser.process_instruction function as the core of the vulnerability.

The patch refactors the process_instruction method significantly. Before the patch, this function handled the logic for XML declarations (<?xml ... ?>) directly. It lacked a mechanism to detect and reject subsequent XML declarations after the first one, which is a violation of the XML specification. The vulnerability description explicitly mentions 'multiple XML declarations' as the cause.

The patch introduces a new method, xml_declaration, and a new instance variable @version to track whether an XML declaration has already been parsed. The process_instruction method is modified to delegate to xml_declaration when it finds a processing instruction with the name 'xml'. The new xml_declaration method now contains the check unless @version.nil?, which raises an exception if a second XML declaration is found, thus mitigating the vulnerability.

Furthermore, the commit message highlights a performance issue with @source.match?(/\s+/um, true) which could cause the parser to read until the end of the file if no match is found. This method was used within process_instruction and likely contributes to the DoS condition when processing the malformed XML. The patch replaces these calls with a more efficient @source.skip_spaces method.

Therefore, the process_instruction function in the vulnerable versions is the exact location where the malicious input is processed, leading to the DoS. A runtime profile during exploitation would show this function being called for each malicious XML declaration in the input file.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.