# A bug of the monkey patch for REXML

**URL:** <https://www.ruby-forum.com/t/a-bug-of-the-monkey-patch-for-rexml/152869>\
**Category:** Ruby\
**Created:** [November 8, 2008, 5:02pm UTC](https://www.ruby-forum.com/t/a-bug-of-the-monkey-patch-for-rexml/152869 "2008-11-08T17:02:54Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shugo\_M](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/7ea924/32.png) [@Shugo\_M](https://www.ruby-forum.com/u/Shugo_M)\
**Post date:** [November 8, 2008, 5:02pm UTC](https://www.ruby-forum.com/t/a-bug-of-the-monkey-patch-for-rexml/152869/1 "2008-11-08T17:02:54Z")

</div>

Hi,

A bug of the monkey patch to fix the DoS vulenerability in REXML has  
been discovered.

[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502535](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=502535)

This is not a vulnerability, but I have fixed the monkey patch.

[http://www.ruby-lang.org/security/20080823rexml/rexml-expansion-fix2.rb](http://www.ruby-lang.org/security/20080823rexml/rexml-expansion-fix2.rb)

The bug has been also fixed in trunk and ruby\_1\_8.

Thanks,