In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-test-unitUpgrade rubygem-typeprofUpgrade rubygems-develUpgrade rubygem-raccUpgrade rubygem-abrt-docUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-rexmlUpgrade rubygem-mysql2-docUpgrade rubygem-rdocUpgrade rubygem-pgUpgrade rubygem-minitestUpgrade rubygem-rbsUpgrade rubygem-power_assertUpgrade rubygem-abrtUpgrade ruby-docUpgrade rubyUpgrade rubygem-io-consoleUpgrade rubygem-bundlerUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-rssUpgrade ruby-default-gemsUpgrade ruby-libsUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade rubygem-irbUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2 | May 9, 2025 | Mar 4, 2025 |
| Alpine Linux | — | Upgrade rubyUpgrade ruby-net-imap | Aug 8, 2025 | Mar 3, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-default-gemsUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-libsUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2Upgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-rdoc | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade ruby-develUpgrade rubyUpgrade ruby-default-gemsUpgrade ruby-bundled-gemsUpgrade rubygem-abrtUpgrade rubygem-rbsUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-rssUpgrade rubygem-bundlerUpgrade rubygem-rexmlUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade ruby-docUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-typeprofUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-raccUpgrade rubygem-minitest | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade rubygem-mysql2-debugsourceUpgrade rubygem-typeprofUpgrade rubygems-develUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-rakeUpgrade rubygem-pg-debuginfoUpgrade rubygem-raccUpgrade rubygem-io-consoleUpgrade rubygem-rbs-debuginfoUpgrade rubygem-rbsUpgrade rubygem-abrtUpgrade ruby-docUpgrade rubygem-rdocUpgrade rubygem-abrt-docUpgrade rubygem-rssUpgrade rubygem-mysql2Upgrade rubygem-rexmlUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pgNo solution existsUpgrade ruby-libsUpgrade rubygem-racc-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygemsUpgrade rubygem-pg-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-test-unitUpgrade ruby-debugsourceUpgrade rubygem-irbUpgrade ruby-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimal | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade rubygem-rbs-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-raccUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pgUpgrade rubygem-json-debuginfoUpgrade rubygem-racc-debuginfoUpgrade ruby-debuginfoUpgrade ruby-develUpgrade ruby-libs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-rbsUpgrade ruby-libsUpgrade rubygem-pg-debugsourceUpgrade ruby-bundled-gemsUpgrade rubyUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-console | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5-doc-riUpgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5-stdlibUpgrade ruby2.5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-devel | Dec 5, 2025 | Jul 3, 2025 |
| Ubuntu | — | Upgrade libruby3.3Upgrade libruby2.7Upgrade ruby3.3Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.0Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.2Upgrade libruby3.0Upgrade ruby2.7Upgrade ruby3.2Upgrade libruby2.5 (Ubuntu Pro) | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub