In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.
CVSS Details
- CVSS 3.1 Base Score: 4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-rakeUpgrade rubygem-pg-docUpgrade rubygem-io-consoleUpgrade rubygem-minitestUpgrade rubygem-typeprofUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade ruby-default-gemsUpgrade rubygem-jsonUpgrade rubygem-rbsUpgrade rubygem-rexmlUpgrade rubygemsUpgrade rubygem-pgUpgrade rubyUpgrade rubygem-rdocUpgrade rubygem-mysql2Upgrade rubygem-psychUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade rubygem-abrt-docUpgrade ruby-bundled-gemsUpgrade rubygem-rssUpgrade ruby-libsUpgrade ruby-docUpgrade rubygem-bundlerUpgrade rubygem-test-unitUpgrade rubygem-abrt | May 9, 2025 | Mar 4, 2025 |
| Amazon_linux_2023 | — | Upgrade ruby3.2-rubygem-typeprofUpgrade ruby3.2-rubygem-jsonUpgrade ruby3.2-develUpgrade ruby3.2-rubygem-bigdecimalUpgrade ruby3.2-rubygem-json-debuginfoUpgrade ruby3.2-debugsourceUpgrade ruby3.2-rubygem-power_assertUpgrade ruby3.2Upgrade ruby3.2-libs-debuginfoUpgrade ruby3.2-rubygem-rexmlUpgrade ruby3.2-debuginfoUpgrade ruby3.2-docUpgrade ruby3.2-rubygem-rbsUpgrade ruby3.2-libsUpgrade ruby3.2-rubygem-rdocUpgrade ruby3.2-rubygem-psych-debuginfoUpgrade ruby3.2-rubygems-develUpgrade ruby3.2-rubygem-bundlerUpgrade ruby3.2-rubygem-rssUpgrade ruby3.2-rubygem-psychUpgrade ruby3.2-rubygem-test-unitUpgrade ruby3.2-bundled-gems-debuginfoUpgrade ruby3.2-rubygem-rakeUpgrade ruby3.2-rubygem-minitestUpgrade ruby3.2-rubygemsUpgrade ruby3.2-rubygem-io-console-debuginfoUpgrade ruby3.2-rubygem-irbUpgrade ruby3.2-rubygem-io-consoleUpgrade ruby3.2-rubygem-bigdecimal-debuginfoUpgrade ruby3.2-default-gemsUpgrade ruby3.2-bundled-gemsUpgrade ruby3.2-rubygem-rbs-debuginfo | Apr 15, 2025 | Mar 3, 2025 |
| Debian | — | Upgrade ruby3.3Upgrade ruby2.7 | Mar 12, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | May 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubyUpgrade ruby-irbUpgrade ruby-help | Jun 13, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade ruby | Jun 11, 2025 | Mar 4, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-help | Jun 11, 2025 | Mar 4, 2025 |
| Oracle_linux | — | Upgrade rubygem-test-unitUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-power_assertUpgrade rubygem-abrtUpgrade rubygem-irbUpgrade ruby-develUpgrade rubygem-rexmlUpgrade rubygem-bundlerUpgrade rubyUpgrade rubygems-develUpgrade rubygem-minitestUpgrade rubygem-mysql2-docUpgrade rubygem-rdocUpgrade ruby-docUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade rubygem-rbsUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade ruby-bundled-gemsUpgrade rubygem-bigdecimalUpgrade ruby-libsUpgrade rubygem-typeprofUpgrade rubygem-abrt-docUpgrade rubygem-rssUpgrade rubygem-psych | Apr 23, 2025 | Mar 3, 2025 |
| Redhat_linux | — | Upgrade rubygem-rdocUpgrade rubygem-rakeUpgrade ruby-debugsourceUpgrade rubygem-io-consoleUpgrade rubygem-psych-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-abrt-docUpgrade rubygem-pg-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-rexmlUpgrade rubygems-develUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-json-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rbsUpgrade rubygem-mysql2-debuginfoUpgrade rubygemsUpgrade rubygem-bundlerUpgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade ruby-default-gemsUpgrade ruby-docUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-psychUpgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-abrtUpgrade ruby-libs-debuginfoUpgrade rubyUpgrade rubygem-minitestUpgrade rubygem-irbUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade rubygem-rssUpgrade ruby-bundled-gemsUpgrade ruby-bundled-gems-debuginfoNo solution exists | Apr 24, 2025 | Mar 4, 2025 |
| Rocky_linux | — | Upgrade rubygem-rbsUpgrade rubygem-mysql2Upgrade rubygem-pg-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubyUpgrade rubygem-pgUpgrade rubygem-jsonUpgrade rubygem-psych-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-psychUpgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade ruby-libsUpgrade rubygem-mysql2-debuginfoUpgrade ruby-debugsource | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade ruby2.5-doc-riUpgrade ruby2.5-devel-extraUpgrade ruby2.5-stdlibUpgrade ruby2.5-docUpgrade ruby2.5Upgrade ruby2.5-develUpgrade libruby2_5-2_5 | Dec 5, 2025 | Apr 24, 2025 |
| Ubuntu | — | Upgrade ruby3.0Upgrade libruby3.2Upgrade libruby2.5 (Ubuntu Pro)Upgrade libruby3.3Upgrade ruby3.3Upgrade ruby2.7Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade ruby3.2Upgrade libruby2.7Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby3.0 | Apr 8, 2025 | Mar 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Mar 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub