In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.
CVSS Details
- CVSS 3.1 Base Score: 4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-abrtUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade rubygem-bigdecimalUpgrade rubygem-rbsUpgrade rubygem-psychUpgrade rubygem-rssUpgrade ruby-libsUpgrade rubyUpgrade rubygem-rexmlUpgrade rubygemsUpgrade ruby-bundled-gemsUpgrade rubygem-irbUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade ruby-docUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-typeprofUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade ruby-develUpgrade ruby-default-gemsUpgrade rubygem-pg-docUpgrade rubygem-power_assert | May 9, 2025 | Mar 4, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-libsUpgrade ruby3.2-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-develUpgrade ruby3.2Upgrade ruby3.2-docUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-default-gemsUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-minitest | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-helpUpgrade rubyUpgrade ruby-irb | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade rubygem-rbsUpgrade rubygem-abrt-docUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygem-typeprofUpgrade rubygem-rssUpgrade rubygem-psychUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade rubygem-abrtUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-test-unitUpgrade ruby-default-gemsUpgrade rubygem-power_assertUpgrade rubygem-irbUpgrade rubygem-rexmlUpgrade rubyUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygemsUpgrade rubygems-develUpgrade rubygem-rdoc | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade ruby-default-gemsUpgrade ruby-docUpgrade rubygem-pgUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psychUpgrade rubygem-rbsUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2Upgrade ruby-bundled-gemsUpgrade rubygemsUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygem-bundlerUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-abrtUpgrade rubygem-pg-docUpgrade rubygem-pg-debugsourceUpgrade rubygem-irbUpgrade rubyUpgrade ruby-libsUpgrade rubygem-rssUpgrade rubygem-bigdecimal-debuginfoNo solution existsUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-typeprofUpgrade rubygems-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-rexmlUpgrade rubygem-rdocUpgrade ruby-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-abrt-docUpgrade rubygem-test-unitUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-docUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade rubygem-rbs-debuginfo | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade ruby-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libsUpgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade ruby-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-jsonUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubygem-io-console-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-rbsUpgrade ruby-bundled-gemsUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade ruby-bundled-gems-debuginfoUpgrade ruby | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade libruby2_5-2_5Upgrade ruby2.5-develUpgrade ruby2.5Upgrade ruby2.5-docUpgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade ruby2.5-stdlib | Dec 5, 2025 | Apr 24, 2025 |
| Ubuntu | — | Upgrade ruby3.2Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby2.7Upgrade ruby3.0Upgrade ruby3.3Upgrade libruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.3Upgrade ruby2.7 | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub