CVE-2021-28965: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days.

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

Affected products

• Fedoraproject Fedora: version 34 only
• Ruby-Lang Rexml: before 3.2.5 (fixed in 3.2.5)
• Ruby-Lang Ruby: before 2.6.7 (fixed in 2.6.7); from 2.7.0, before 2.7.3 (fixed in 2.7.3); from 3.0.0, before 3.0.1 (fixed in 3.0.1)

Published 2021-04-21. Last modified 2026-06-17.