REXML versions before 3.2.7 contain a denial of service (DoS) vulnerability triggered by parsing XML with many '>' characters in an attribute value. This can cause the parser to consume excessive resources, leading to service disruption. The vulnerability is fixed in version 3.2.7. Users are advised not to parse untrusted XML data if they cannot upgrade.