Denial of Service Vulnerability in CGI Library for Ruby by Ruby
CVE-2025-27219

7.5HIGH

Key Information:

Vendor

Ruby-lang

Status
Cgi
Vendor
CVE Published:
4 March 2025

What is CVE-2025-27219?

The CGI library in Ruby prior to version 0.4.2 contains a vulnerability in the CGI::Cookie.parse method. This flaw allows for extremely large raw cookie values to be processed without any restrictions, leading to potential excessive resource consumption and denial of service. This vulnerability arises from the lack of input size validation, making systems that utilize this library susceptible to exploitation if a malicious user inputs oversized cookie values.

Affected Version(s)

CGI 0 < 0.3.5.1

CGI 0.3.6 < 0.3.7

CGI 0.4.0 < 0.4.2

References

https://hackerone.com/reports/2936778
https://github.com/rubysec/ruby-advisory-db/blob/master/g...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.