GHSA-gh9q-2xrm-x6qv

    Dashboard / Vulnerabilities / GHSA-gh9q-2xrm-x6qv

    GHSA-gh9q-2xrm-x6qv

    Published: 3 Mar 2025Last Modified: 10 Sept 2026

    Summary: CGI has Denial of Service (DoS) potential in Cookie.parse

    Details: There is a possibility for DoS by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem. ## Details CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service. Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. ## Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. ## Credits Thanks to lio346 for discovering this issue. Also thanks to mame for fixing this vulnerability.

    References: https://nvd.nist.gov/vuln/detail/CVE-2025-27219, https://github.com/ruby/cgi/pull/52, https://github.com/ruby/cgi/pull/53, https://github.com/ruby/cgi/pull/54, https://hackerone.com/reports/2936778, https://github.com/ruby/cgi, https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml, https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html, https://www.cve.org/CVERecord?id=CVE-2025-27219

    Affected packages

    Package

    Name: cgi

    Purl: pkg:gem/cgi

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -0.3.5.1

    Affected versions

    0.1.0
    0.1.0.1
    0.1.0.2
    0.1.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-gh9q-2xrm-x6qv | CVE-DB