Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-28965

26
FAUCET Score

CVE-2021-28965 is a high-severity vulnerability affecting the REXML gem in Ruby versions prior to 2.6.7, 2.7.3, and 3.0.1, as well as various Fedora and Ruby-related products. It involves improper handling of XML round-trip issues, leading to the production of an incorrect document after parsing and serialization. With a CVSS score of 7.5 (High), this vulnerability is network-exploitable with low attack complexity and can result in high integrity impact, though confidentiality and availability are not affected. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in the KEV catalog. Community discussion and media coverage are minimal, with only one mention and one article, primarily from GitLab's security release.

Impacted Technologies

VendorProductVersion(s)CPE
< 3.2.5CPE matchmatch criteria
cpe:2.3:a:ruby-lang:rexml:*:*:*:*:*:ruby:*:*
< 2.6.7CPE matchmatch criteria
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
>= 2.7.0, < 2.7.3CPE matchmatch criteria
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
>= 3.0.0, < 3.0.1CPE matchmatch criteria
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
34CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
5.06%
Probability of exploitation in next 30 days
EPSS Percentile
91.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0506 is in the 85th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (22)

microsoftpatch availablevia msrc
Product: 17016-16820Fixed in: 2.6.7-1
microsoftpatch availablevia msrc
Product: 19017-16823Fixed in: 2.7.4-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 2.7.4-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 2.7.4-1
microsoftpatch availablevia msrc
Product: cm1 ruby 2.6.7-1 on CBL Mariner 1.0Fixed in: 2.6.7-1
microsoftpatch availablevia msrc
Product: cbl2 ruby 2.7.4-1 on CBL Mariner 2.0Fixed in: 2.7.4-1
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 x64Fixed in: 2.6.7-1
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 ARMFixed in: 2.6.7-1
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby26-ruby-0:2.6.7-119.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-ruby25-ruby-0:2.5.9-9.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-ruby27-ruby-0:2.7.3-129.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-ruby26-ruby-0:2.6.7-119.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-ruby25-ruby-0:2.5.9-9.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: ruby:2.7-8040020210421133318.522a0ee4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: ruby:2.5-8040020200923213910.522a0ee4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: ruby:2.6-8040020210430142949.522a0ee4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.1 Update Services for SAP SolutionsFixed in: ruby:2.6-8010020220201152941.c27ad7f8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Extended Update SupportFixed in: ruby:2.6-8020020220201131207.4cda2c84
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby25-ruby-0:2.5.9-9.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby27-ruby-0:2.7.3-129.el7
View patch
rubygemspatch availablevia ghsa
Product: rexmlFixed in: 3.2.5
redhatno patchvia redhat_api
Product: Red Hat Software CollectionsFixed in: rh-ruby30-ruby

Vendor Advisories (4)

microsoft2023-Mar/CVE-2021-28965

CVE-2021-28965

Mar 14, 2023
rubygemsGHSA-8cr8-4vfw-mr7hhigh

REXML round-trip instability

Apr 30, 2021
microsoft2021-Apr/CVE-2021-28965Important

The REXML gem before 3.2.5 in Ruby before 2.6.7 2.7.x before 2.7.3 and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

Apr 13, 2021
redhatCVE-2021-28965Moderate

ruby: XML round-trip vulnerability in REXML

Apr 5, 2021

References

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/WTVFTLFVCSUE5CXHINJEUCKSHU4SWDMT
security.netapp.com / advisory/ntap-20210528-0003
Third Party Advisory
ruby-lang.org / en/news/2021/04/05/xml-round-trip-vulnerability-in-rexml-cve-2021-28965
Vendor Advisory