In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-rbsUpgrade rubygem-pgUpgrade ruby-default-gemsUpgrade rubygemsUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-irbUpgrade rubygem-minitestUpgrade ruby-develUpgrade rubygem-power_assertUpgrade ruby-libsUpgrade ruby-bundled-gemsUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-bundlerUpgrade rubyUpgrade rubygem-rssUpgrade rubygem-typeprofUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade rubygem-raccUpgrade rubygem-rexmlUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-rakeUpgrade rubygem-mysql2-docUpgrade rubygem-rdoc | May 9, 2025 | Mar 4, 2025 |
| Alpine Linux | — | Upgrade rubyUpgrade ruby-net-imap | Aug 8, 2025 | Mar 3, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-bundled-gemsUpgrade ruby3.2-libsUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-debuginfoUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2Upgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-json | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-raccUpgrade rubygem-typeprofUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-rbsUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-rssUpgrade rubyUpgrade ruby-develUpgrade rubygem-rexmlUpgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubygem-irbUpgrade ruby-default-gemsUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygem-abrtUpgrade ruby-bundled-gems | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade rubygem-mysql2Upgrade rubygem-pgUpgrade ruby-bundled-gems-debuginfoNo solution existsUpgrade ruby-libsUpgrade rubygem-racc-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade ruby-bundled-gemsUpgrade ruby-docUpgrade rubyUpgrade ruby-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-test-unitUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-rssUpgrade rubygem-irbUpgrade rubygem-psychUpgrade rubygem-bundlerUpgrade rubygem-psych-debuginfoUpgrade rubygem-rbsUpgrade rubygem-rdocUpgrade rubygem-rexmlUpgrade rubygem-abrtUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygems-develUpgrade rubygem-io-consoleUpgrade rubygem-power_assertUpgrade rubygem-raccUpgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade rubygem-mysql2-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pg-debuginfoUpgrade ruby-default-gemsUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade rubygem-minitest | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-bigdecimal-debuginfoUpgrade rubyUpgrade rubygem-bigdecimalUpgrade rubygem-psychUpgrade rubygem-pg-debuginfoUpgrade rubygem-rbsUpgrade rubygem-mysql2Upgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debugsourceUpgrade ruby-bundled-gemsUpgrade ruby-debugsourceUpgrade ruby-libsUpgrade rubygem-json-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-develUpgrade rubygem-pgUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-racc-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-racc | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5-doc-riUpgrade ruby2.5-stdlibUpgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-devel | Dec 5, 2025 | Jul 3, 2025 |
| Ubuntu | — | Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.7Upgrade libruby3.2Upgrade ruby3.2Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby3.0Upgrade libruby2.7Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby3.3Upgrade libruby3.3 | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub