Denial of Service Vulnerability in CGI Library for Ruby by Ruby
CVE-2025-27219

5.8MEDIUM

Key Information:

Vendor

Ruby-lang

Status
Cgi
Vendor
CVE Published:
4 March 2025

What is CVE-2025-27219?

The CGI library in Ruby prior to version 0.4.2 contains a vulnerability in the CGI::Cookie.parse method. This flaw allows for extremely large raw cookie values to be processed without any restrictions, leading to potential excessive resource consumption and denial of service. This vulnerability arises from the lack of input size validation, making systems that utilize this library susceptible to exploitation if a malicious user inputs oversized cookie values.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

CGI 0 < 0.3.5.1

CGI 0.3.6 < 0.3.7

CGI 0.4.0 < 0.4.2

References

https://hackerone.com/reports/2936778
https://github.com/rubysec/ruby-advisory-db/blob/master/g...

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.