In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.
CVSS Details
- CVSS 3.1 Base Score: 4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade ruby-default-gemsUpgrade rubygem-io-consoleUpgrade rubygem-typeprofUpgrade rubygem-rakeUpgrade ruby-docUpgrade ruby-libsUpgrade rubygem-abrtUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-bundlerUpgrade rubygem-mysql2Upgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-pgUpgrade rubygem-bigdecimalUpgrade rubygem-rexmlUpgrade rubygem-rbsUpgrade rubygem-irbUpgrade rubygem-abrt-docUpgrade ruby-bundled-gemsUpgrade rubygem-rssUpgrade rubyUpgrade rubygem-test-unit | May 9, 2025 | Mar 4, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2Upgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-debugsourceUpgrade ruby3.2-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-default-gemsUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-rbs-debuginfoUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-io-console-debuginfo | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade rubyUpgrade ruby-helpUpgrade ruby-irb | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade ruby-default-gemsUpgrade rubygem-test-unitUpgrade rubygem-mysql2-docUpgrade rubygem-power_assertUpgrade rubygem-rexmlUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygemsUpgrade rubygem-pgUpgrade ruby-docUpgrade rubygem-abrtUpgrade rubygem-minitestUpgrade rubyUpgrade rubygems-develUpgrade rubygem-rdocUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-typeprofUpgrade rubygem-bigdecimalUpgrade ruby-bundled-gemsUpgrade rubygem-io-consoleUpgrade rubygem-pg-docUpgrade rubygem-abrt-docUpgrade rubygem-rbsUpgrade rubygem-mysql2Upgrade rubygem-rakeUpgrade rubygem-rss | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade ruby-bundled-gemsUpgrade rubygem-power_assertUpgrade rubygem-rssUpgrade rubygem-mysql2Upgrade rubygemsUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-bundlerUpgrade rubygem-jsonUpgrade ruby-libs-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-abrtUpgrade rubygem-psychUpgrade rubygem-pg-docUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pgNo solution existsUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rbsUpgrade ruby-docUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-irbUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-rexmlUpgrade rubygem-io-console-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-json-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade rubygem-rdocUpgrade ruby-debugsourceUpgrade rubygem-mysql2-docUpgrade rubygem-test-unitUpgrade rubygem-rbs-debuginfoUpgrade rubygem-abrt-docUpgrade rubygems-develUpgrade rubygem-typeprof | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade rubygem-pg-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade ruby-debuginfoUpgrade ruby-debugsourceUpgrade ruby-develUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-mysql2-debuginfoUpgrade rubyUpgrade rubygem-io-console-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-jsonUpgrade rubygem-rbsUpgrade ruby-bundled-gems | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade libruby2_5-2_5Upgrade ruby2.5-develUpgrade ruby2.5Upgrade ruby2.5-docUpgrade ruby2.5-devel-extraUpgrade ruby2.5-doc-riUpgrade ruby2.5-stdlib | Dec 5, 2025 | Apr 24, 2025 |
| Ubuntu | — | Upgrade libruby2.7Upgrade libruby3.0Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.2Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.7Upgrade ruby3.0Upgrade libruby3.3Upgrade ruby3.3Upgrade libruby3.2Upgrade libruby2.5 (Ubuntu Pro) | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub