CVE-2013-1821: lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial o...

Security readout for executives and security teams

CVE-2013-1821 is a denial-of-service flaw in Ruby's bundled REXML XML parser before Ruby 1.9.3-p392. A crafted XML document can make a vulnerable application consume memory and crash, affecting availability rather than confidentiality or data integrity based on the supplied sources. Exposure is most likely in legacy Ruby applications or packaged Ruby runtimes that parse untrusted XML with REXML. Internet-facing XML endpoints, file importers, SOAP-style integrations, and background jobs processing user-supplied XML deserve review. Treat this as a legacy availability risk. It should be remediated during normal vulnerability maintenance, with faster action for exposed services that accept XML from unauthenticated or untrusted sources. Mitigation focus: Upgrade Ruby or vendor packages to a fixed release, including Ruby 1.9.3-p392 or later where applicable.; Apply relevant distribution security updates from Red Hat, Debian, Ubuntu, SUSE, Slackware, Mageia, or Mandriva.; Identify code paths that parse untrusted XML with REXML and reduce exposure where upgrades are delayed..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.