A Regular Expression Denial of Service (ReDoS) vulnerability exists in the REXML gem versions before 3.3.9. This vulnerability occurs when parsing XML containing many digits between '&#' and 'x...;' in a hex numeric character reference. Ruby 3.1 is affected, while Ruby 3.2 and later are not. The issue is fixed in REXML version 3.3.9.