CVE-2025-27219 – cgi

Package

Manager: gem
Name: cgi
Vulnerable Version: >=0 <0.3.5.1 || =0.3.6 || >=0.3.6 <0.3.7 || >=0.4.0 <0.4.2

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS: 0.00348 pctl0.5677

Details

CGI has Denial of Service (DoS) potential in Cookie.parse There is a possibility for DoS by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem. ## Details CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service. Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. ## Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. ## Credits Thanks to lio346 for discovering this issue. Also thanks to mame for fixing this vulnerability.

Metadata

Created: 2025-03-03T20:53:43Z
Modified: 2025-03-04T16:37:51Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-gh9q-2xrm-x6qv/GHSA-gh9q-2xrm-x6qv.json
CWE IDs: ["CWE-400", "CWE-770"]
Alternative ID: GHSA-gh9q-2xrm-x6qv
Finding: F002
Auto approve: 1