A denial-of-service (DoS) vulnerability exists in the REXML gem versions before 3.3.3 when parsing XML documents containing many entity expansions using the SAX2 or pull parser API. This can cause application unavailability if untrusted XML input is processed with these APIs. The issue is fixed in version 3.3.3.