In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.
CVSS Details
- CVSS 3.1 Base Score: 4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ruby-develUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade ruby-default-gemsUpgrade rubygem-minitestUpgrade rubygem-typeprofUpgrade rubygem-rakeUpgrade rubygem-power_assertUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-docUpgrade rubyUpgrade rubygem-rbsUpgrade rubygem-bundlerUpgrade rubygem-test-unitUpgrade rubygem-abrt-docUpgrade ruby-bundled-gemsUpgrade rubygem-rssUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade rubygem-abrtUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-rexmlUpgrade ruby-docUpgrade rubygem-irbUpgrade rubygem-json | May 9, 2025 | Mar 4, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2Upgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-docUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-develUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-json-debuginfo | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-rssUpgrade rubygem-rbsUpgrade rubygem-psychUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade rubygem-power_assertUpgrade ruby-default-gemsUpgrade rubygems-develUpgrade rubygem-rdocUpgrade rubygem-irbUpgrade rubygem-test-unitUpgrade rubygem-minitestUpgrade rubyUpgrade ruby-docUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-rexmlUpgrade rubygemsUpgrade rubygem-mysql2-docUpgrade rubygem-abrt | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade rubygem-pgUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade rubygem-mysql2-debuginfoUpgrade ruby-bundled-gems-debuginfoNo solution existsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-irbUpgrade rubygem-mysql2Upgrade rubyUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-abrtUpgrade rubygem-power_assertUpgrade ruby-libs-debuginfoUpgrade ruby-libsUpgrade rubygem-pg-docUpgrade ruby-bundled-gemsUpgrade rubygem-rbsUpgrade ruby-docUpgrade rubygem-bundlerUpgrade ruby-default-gemsUpgrade rubygem-rssUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-abrt-docUpgrade rubygem-typeprofUpgrade rubygem-pg-debuginfoUpgrade rubygem-rexmlUpgrade ruby-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-rdocUpgrade ruby-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-psych-debuginfo | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libsUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-mysql2-debuginfoUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade ruby-bundled-gemsUpgrade rubyUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-io-console-debuginfoUpgrade rubygem-rbsUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade ruby-bundled-gems-debuginfo | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5Upgrade ruby2.5-develUpgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade ruby2.5-stdlib | Dec 5, 2025 | Apr 24, 2025 |
| Ubuntu | — | Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby3.2Upgrade libruby2.7Upgrade libruby3.0Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby2.7Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.3Upgrade ruby3.0Upgrade libruby3.2Upgrade ruby3.3 | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub