In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubyUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-psychUpgrade ruby-libsUpgrade rubygem-irbUpgrade rubygem-abrtUpgrade rubygem-io-consoleUpgrade rubygemsUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade ruby-default-gemsUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade ruby-docUpgrade rubygem-rssUpgrade rubygem-mysql2Upgrade rubygem-rbsUpgrade rubygem-rakeUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-raccUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade rubygem-test-unitUpgrade rubygems-develUpgrade rubygem-rexmlUpgrade rubygem-typeprof | May 9, 2025 | Mar 4, 2025 |
| Alpine Linux | — | Upgrade rubyUpgrade ruby-net-imap | Aug 8, 2025 | Mar 3, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2Upgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-libsUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-default-gems | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade rubygem-abrt-docUpgrade rubygem-minitestUpgrade rubygem-typeprofUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-raccUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade ruby-docUpgrade ruby-develUpgrade rubygem-mysql2Upgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-rssUpgrade rubygem-rexmlUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade ruby-default-gemsUpgrade rubygem-bigdecimalUpgrade rubygem-abrtUpgrade rubygem-rbsUpgrade rubygem-io-consoleUpgrade ruby-bundled-gemsUpgrade rubygem-psychUpgrade rubygem-rake | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade ruby-docUpgrade rubygem-rdocUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psychUpgrade rubygem-pg-debugsourceUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubygem-racc-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-rssUpgrade rubygemsUpgrade ruby-libsUpgrade rubygem-abrt-docUpgrade ruby-libs-debuginfoUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-bigdecimalUpgrade rubyUpgrade ruby-debuginfoUpgrade rubygem-irbUpgrade rubygem-mysql2Upgrade rubygem-abrtNo solution existsUpgrade rubygem-test-unitUpgrade rubygem-rexmlUpgrade rubygem-rbsUpgrade rubygem-psych-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rakeUpgrade ruby-default-gemsUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-racc | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade ruby-libsUpgrade rubygem-mysql2-debugsourceUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rbsUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-bigdecimalUpgrade ruby-bundled-gemsUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-psychUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-raccUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade rubygem-racc-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-devel | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5-doc-riUpgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5-docUpgrade ruby2.5-develUpgrade ruby2.5Upgrade ruby2.5-devel-extra | Dec 5, 2025 | Jul 3, 2025 |
| Ubuntu | — | Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby2.7Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby3.0Upgrade ruby3.2Upgrade libruby3.0Upgrade libruby3.3Upgrade libruby2.7Upgrade ruby3.3Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro) | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub