In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-raccUpgrade rubygem-typeprofUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade rubygem-rexmlUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-rakeUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygem-rbsUpgrade rubygem-mysql2Upgrade rubygemsUpgrade rubygem-pgUpgrade rubygem-rssUpgrade ruby-develUpgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-power_assertUpgrade ruby-docUpgrade rubygem-minitestUpgrade ruby-bundled-gemsUpgrade rubygem-abrtUpgrade ruby-default-gemsUpgrade ruby-libsUpgrade rubygem-irbUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-pg-doc | May 9, 2025 | Mar 4, 2025 |
| Alpine Linux | — | Upgrade rubyUpgrade ruby-net-imap | Aug 8, 2025 | Mar 3, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygems-develUpgrade ruby3.2Upgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-default-gemsUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-libsUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygem-power_assert | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-typeprofUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-raccUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-io-consoleUpgrade rubygem-rbsUpgrade rubygem-rakeUpgrade rubygem-mysql2Upgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-test-unitUpgrade rubygem-rssUpgrade rubygem-bigdecimalUpgrade rubygem-rexmlUpgrade rubygem-bundlerUpgrade ruby-libsUpgrade rubygem-abrtUpgrade ruby-bundled-gemsUpgrade rubygem-irbUpgrade ruby-default-gemsUpgrade ruby-develUpgrade rubyUpgrade rubygem-psych | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-typeprofUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-power_assertUpgrade ruby-develUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygem-raccUpgrade rubygem-rakeUpgrade ruby-libs-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-abrtUpgrade rubygem-rdocUpgrade rubygem-rssUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubygem-rbs-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-bundlerUpgrade rubygem-psychUpgrade ruby-debugsourceUpgrade rubygem-mysql2Upgrade ruby-bundled-gems-debuginfoNo solution existsUpgrade rubygem-pgUpgrade rubygem-test-unitUpgrade ruby-debuginfoUpgrade rubyUpgrade rubygem-rbsUpgrade rubygem-rexmlUpgrade rubygem-irbUpgrade rubygemsUpgrade ruby-docUpgrade rubygem-psych-debuginfo | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade rubygem-mysql2Upgrade rubyUpgrade rubygem-pg-debuginfoUpgrade rubygem-rbsUpgrade ruby-debugsourceUpgrade rubygem-psychUpgrade rubygem-bigdecimalUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-bundled-gemsUpgrade ruby-libsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-io-console-debuginfoUpgrade ruby-develUpgrade rubygem-racc-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pgUpgrade rubygem-mysql2-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-racc | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5Upgrade ruby2.5-devel-extraUpgrade ruby2.5-develUpgrade libruby2_5-2_5Upgrade ruby2.5-doc-riUpgrade ruby2.5-stdlibUpgrade ruby2.5-doc | Dec 5, 2025 | Jul 3, 2025 |
| Ubuntu | — | Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby2.7Upgrade ruby3.0Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby3.3Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.7Upgrade ruby3.3 | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub