Issue #21632 has been updated by naitoh (Jun NAITOH). Status changed from Feedback to Closed Backport changed from 3.2: REQUIRED, 3.3: DONE, 3.4: DONE to 3.2: DONE, 3.3: DONE, 3.4: DONE Merged. ---------------------------------------- Bug #21632: Backport REXML CVE-2025-58767 fix https://bugs.ruby-lang.org/issues/21632#change-114865 * Author: Bo98 (Bo Anderson) * Status: Closed * Backport: 3.2: DONE, 3.3: DONE, 3.4: DONE ---------------------------------------- Even though it's a bundled gem and not a default gem, it would be worthwhile backporting the fix for CVE-2025-58767 (https://www.ruby-lang.org/en/news/2025/09/18/dos-rexml-cve-2025-58767/). Ruby 3.4 PR: https://github.com/ruby/ruby/pull/14795 Ruby 3.3 PR: https://github.com/ruby/ruby/pull/14796 I'm not sure what to do for Ruby 3.2. It's a security fix so it qualifies for a backport, but there's other changes included in a version bump. Do we need a rexml 3.3.9.1? -- https://bugs.ruby-lang.org/