In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-pgUpgrade rubygem-bundlerUpgrade rubygem-rbsUpgrade ruby-develUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade ruby-default-gemsUpgrade rubyUpgrade rubygemsUpgrade ruby-libsUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-irbUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubygem-rssUpgrade rubygem-abrt-docUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygem-typeprofUpgrade rubygem-raccUpgrade rubygem-bigdecimalUpgrade rubygem-rexmlUpgrade rubygem-mysql2-doc | May 9, 2025 | Mar 4, 2025 |
| Alpine Linux | — | Upgrade ruby-net-imapUpgrade ruby | Aug 8, 2025 | Mar 3, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2Upgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-develUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-bigdecimal | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-typeprofUpgrade rubygem-raccUpgrade rubygems-develUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-power_assertUpgrade rubygem-mysql2-docUpgrade rubygem-rssUpgrade rubygem-rexmlUpgrade ruby-default-gemsUpgrade rubygem-bigdecimalUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-test-unitUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade rubygem-rbsUpgrade rubygem-abrtUpgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade ruby-doc | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-pg-debugsourceUpgrade rubygem-abrtUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rexmlUpgrade rubyUpgrade rubygem-test-unitUpgrade ruby-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-rbsUpgrade rubygem-irbUpgrade rubygem-rssUpgrade rubygem-pgUpgrade rubygem-mysql2No solution existsUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygem-rbs-debuginfoUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-bundlerUpgrade ruby-bundled-gemsUpgrade rubygem-power_assertUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade ruby-default-gemsUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2-docUpgrade rubygem-minitestUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade rubygem-raccUpgrade rubygem-mysql2-debuginfoUpgrade ruby-devel | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade rubygem-io-console-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade rubygem-rbs-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-develUpgrade rubygem-racc-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-raccUpgrade rubygem-json-debuginfoUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade rubygem-mysql2-debugsourceUpgrade ruby-debugsourceUpgrade rubyUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade ruby-bundled-gemsUpgrade rubygem-pg-debugsourceUpgrade rubygem-rbsUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-console | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-develUpgrade libruby2_5-2_5Upgrade ruby2.5-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.5-doc | Dec 5, 2025 | Jul 3, 2025 |
| Ubuntu | — | Upgrade libruby3.2Upgrade ruby3.2Upgrade libruby3.0Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade ruby3.0Upgrade ruby2.7Upgrade ruby3.3Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.7Upgrade libruby3.3 | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub