In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.
CVSS Details
- CVSS 3.1 Base Score: 4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade ruby-develUpgrade rubygem-typeprofUpgrade rubygem-minitestUpgrade rubygem-mysql2-docUpgrade ruby-default-gemsUpgrade rubygem-power_assertUpgrade rubygem-pg-docUpgrade rubygem-irbUpgrade rubygem-rexmlUpgrade rubygem-rbsUpgrade rubygem-psychUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-abrtUpgrade rubygem-jsonUpgrade rubygem-rssUpgrade rubygem-abrt-docUpgrade ruby-bundled-gemsUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade ruby | May 9, 2025 | Mar 4, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-debuginfoUpgrade ruby3.2-develUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2Upgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-test-unit | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby2.7Upgrade ruby3.3 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade ruby | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-rakeUpgrade rubygem-jsonUpgrade rubygem-rbsUpgrade rubygem-psychUpgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-rssUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade rubygem-minitestUpgrade rubygem-power_assertUpgrade rubyUpgrade rubygemsUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygem-pgUpgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubygems-develUpgrade rubygem-rdocUpgrade ruby-default-gemsUpgrade rubygem-rexmlUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade ruby-devel | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade rubygem-rakeUpgrade ruby-debugsourceUpgrade rubygem-rdocUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-abrt-docUpgrade rubygem-rbs-debuginfoUpgrade rubygem-mysql2-docUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-psych-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-typeprofUpgrade rubygem-rexmlUpgrade rubygems-develUpgrade rubygem-pg-debuginfoUpgrade rubygem-pg-docUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade ruby-default-gemsUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-power_assertUpgrade rubygem-rssUpgrade ruby-bundled-gemsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-psychUpgrade rubygem-abrtUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-bundled-gems-debuginfoNo solution existsUpgrade ruby-libsUpgrade rubygem-irbUpgrade rubyUpgrade rubygemsUpgrade rubygem-rbsUpgrade rubygem-mysql2 | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade ruby-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-psychUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-io-console-debuginfoUpgrade rubyUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade rubygem-rbs | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5-develUpgrade ruby2.5-docUpgrade libruby2_5-2_5Upgrade ruby2.5Upgrade ruby2.5-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.5-devel-extra | Dec 5, 2025 | Apr 24, 2025 |
| Ubuntu | — | Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby3.2Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.7Upgrade libruby3.2Upgrade ruby3.0Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby3.3Upgrade libruby3.3Upgrade ruby2.7 | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub