In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
CVSS Details
- CVSS 3.1 Base Score: 5.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-rexmlUpgrade rubygem-raccUpgrade rubygem-typeprofUpgrade rubygems-develUpgrade rubygem-test-unitUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubyUpgrade rubygem-irbUpgrade rubygem-pg-docUpgrade rubygem-jsonUpgrade ruby-default-gemsUpgrade rubygem-io-consoleUpgrade rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-pgUpgrade ruby-develUpgrade rubygem-rssUpgrade rubygemsUpgrade rubygem-psychUpgrade rubygem-bundlerUpgrade rubygem-minitestUpgrade rubygem-rbsUpgrade rubygem-abrtUpgrade ruby-bundled-gemsUpgrade ruby-libsUpgrade ruby-doc | May 9, 2025 | Mar 4, 2025 |
| Alpine Linux | — | Upgrade rubyUpgrade ruby-net-imap | Aug 8, 2025 | Mar 3, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2Upgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-develUpgrade ruby3.2-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-irb | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade ruby-default-gemsUpgrade rubygem-test-unitUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-rssUpgrade rubygem-rakeUpgrade rubygem-rexmlUpgrade rubygem-rbsUpgrade ruby-develUpgrade rubyUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-irbUpgrade ruby-docUpgrade ruby-bundled-gemsUpgrade rubygem-bundlerUpgrade rubygem-psychUpgrade rubygem-abrtUpgrade rubygem-io-consoleUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade rubygemsUpgrade rubygem-minitestUpgrade rubygem-typeprofUpgrade rubygem-raccUpgrade rubygem-power_assertUpgrade rubygem-mysql2-doc | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade rubygem-mysql2-docUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygems-develUpgrade ruby-develUpgrade rubygem-typeprofUpgrade rubygem-pg-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rakeUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-raccUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-power_assertUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-bigdecimalUpgrade rubygem-bundlerUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-irbNo solution existsUpgrade ruby-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-abrtUpgrade ruby-docUpgrade rubygem-rssUpgrade rubygem-abrt-docUpgrade rubygem-rdocUpgrade rubygem-pg-debugsourceUpgrade rubygem-rbs-debuginfoUpgrade ruby-libsUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-racc-debuginfoUpgrade rubygem-rbsUpgrade rubygem-rexmlUpgrade rubygem-jsonUpgrade ruby-debugsourceUpgrade rubygem-test-unit | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade rubygem-raccUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-pgUpgrade ruby-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-racc-debuginfoUpgrade ruby-develUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-pg-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-rbsUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade rubyUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-debugsourceUpgrade rubygem-psych | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade libruby2_5-2_5Upgrade ruby2.5-docUpgrade ruby2.5-doc-riUpgrade ruby2.5-stdlibUpgrade ruby2.5-develUpgrade ruby2.5Upgrade ruby2.5-devel-extra | Dec 5, 2025 | Jul 3, 2025 |
| Ubuntu | — | Upgrade ruby3.3Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.7Upgrade libruby3.3Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.2Upgrade ruby2.7Upgrade ruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby3.0 | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub