A denial of service (DoS) vulnerability exists in the REXML gem versions before 3.3.2. This vulnerability occurs when parsing XML containing many specific characters such as '<', '0', and '%>'. Parsing untrusted XML with these versions may lead to DoS conditions. The issue is fixed in REXML version 3.3.2 and later.