In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-rssUpgrade rubygem-mysql2Upgrade ruby-develUpgrade rubygemsUpgrade rubygem-io-consoleUpgrade rubygem-power_assertUpgrade ruby-bundled-gemsUpgrade rubygem-irbUpgrade rubygem-abrtUpgrade rubyUpgrade ruby-docUpgrade rubygem-jsonUpgrade ruby-default-gemsUpgrade rubygem-rbsUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade ruby-libsUpgrade rubygem-test-unitUpgrade rubygem-raccUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-rakeUpgrade rubygem-rexmlUpgrade rubygem-typeprofUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-bigdecimal | May 9, 2025 | Mar 4, 2025 |
| Alpine Linux | — | Upgrade ruby-net-imapUpgrade ruby | Aug 8, 2025 | Mar 3, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-default-gemsUpgrade ruby3.2-libsUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2Upgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-debuginfoUpgrade ruby3.2-devel | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade ruby-docUpgrade rubygem-test-unitUpgrade ruby-develUpgrade rubyUpgrade rubygem-rbsUpgrade rubygem-io-consoleUpgrade rubygem-abrtUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade ruby-default-gemsUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade ruby-libsUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-bundlerUpgrade rubygem-rexmlUpgrade rubygem-bigdecimalUpgrade rubygem-rssUpgrade rubygem-abrt-docUpgrade rubygem-pg-docUpgrade rubygem-rdocUpgrade rubygem-raccUpgrade rubygem-minitestUpgrade rubygem-typeprofUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygems-devel | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-mysql2-docUpgrade rubygem-raccUpgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade ruby-default-gemsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rdocUpgrade rubygem-pgUpgrade ruby-bundled-gemsUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade rubyUpgrade ruby-debuginfoUpgrade rubygem-rssUpgrade rubygem-abrt-docUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-abrtUpgrade rubygem-psych-debuginfoUpgrade rubygem-rbsUpgrade ruby-libsUpgrade rubygem-rbs-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-bundlerUpgrade rubygem-psychUpgrade rubygem-pg-debugsourceNo solution existsUpgrade rubygem-rexml | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade rubygem-json-debuginfoUpgrade rubygem-raccUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-pg-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-rbsUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubyUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsource | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-develUpgrade ruby2.5-doc-riUpgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade libruby2_5-2_5 | Dec 5, 2025 | Jul 3, 2025 |
| Ubuntu | — | Upgrade ruby3.0Upgrade ruby2.7Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.0Upgrade libruby3.2Upgrade ruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby3.3Upgrade libruby2.7Upgrade libruby3.3Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro) | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub