A denial of service (DoS) vulnerability exists in the REXML gem versions prior to 3.3.6. The issue occurs when parsing XML documents with many deeply nested elements sharing the same local name attributes using the tree parser API. Other parser APIs such as stream parser and SAX2 parser are not affected. The vulnerability is fixed in version 3.3.6.