p PatchFirst

CVE-2025-27219

CVE-2025-27219

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.

CVSS 5.8 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • cgi

    Versions
    • ≥ 0, < 0.3.5.1: Affected (custom)
    • ≥ 0.3.6, < 0.3.7: Affected (custom)
    • ≥ 0.4.0, < 0.4.2: Affected (custom)

    Update to 0.3.5.1; Update to 0.3.7; Update to 0.4.2

  • ruby3.1 Debian:12

    Versions
    • 3.1.2-7
    • 3.1.2-7+deb12u1
    • 3.1.2-7+hurd.1
    • 3.1.2-8
    • 3.1.2-8.1~exp1
    • 3.1.2-8.3
    • 3.1.2-8.4
    • 3.1.2-8.5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.3 Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.3.7-2

    Update to 3.3.7-2

  • ruby3.3 Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.3.7-2

    Update to 3.3.7-2

  • jruby Ubuntu:Pro:14.04:LTS

    Versions
    • 1.5.6-5ubuntu1
    • 1.5.6-6
    • 1.5.6-7
    • 1.5.6-9+deb8u2build0.14.04.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.3 Ubuntu:Pro:16.04:LTS

    Versions
    • 2.3.0-1
    • 2.3.0-2
    • 2.3.0-4ubuntu2
    • 2.3.0-4ubuntu3
    • 2.3.0-5ubuntu1
    • 2.3.1-2~16.04
    • 2.3.1-2~16.04.2
    • 2.3.1-2~16.04.4
    • 2.3.1-2~16.04.5
    • 2.3.1-2~16.04.6
    • 2.3.1-2~16.04.7
    • 2.3.1-2~16.04.9
    • 2.3.1-2~16.04.10
    • 2.3.1-2~16.04.11
    • 2.3.1-2~16.04.12
    • 2.3.1-2~ubuntu16.04.13
    • 2.3.1-2~ubuntu16.04.14
    • 2.3.1-2~ubuntu16.04.15
    • 2.3.1-2~ubuntu16.04.16
    • 2.3.1-2~ubuntu16.04.16+esm1
    • 2.3.1-2~ubuntu16.04.16+esm2
    • 2.3.1-2~ubuntu16.04.16+esm3
    • 2.3.1-2~ubuntu16.04.16+esm4
    • 2.3.1-2~ubuntu16.04.16+esm5
    • 2.3.1-2~ubuntu16.04.16+esm6
    • 2.3.1-2~ubuntu16.04.16+esm7
    • 2.3.1-2~ubuntu16.04.16+esm8
    • 2.3.1-2~ubuntu16.04.16+esm9
    Affected ranges
    • ECOSYSTEM: < 2.3.1-2~ubuntu16.04.16+esm10

    Update to 2.3.1-2~ubuntu16.04.16+esm10

  • jruby Ubuntu:16.04:LTS

    Versions
    • 1.7.21-2ubuntu4
    • 1.7.22-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.5 Ubuntu:Pro:18.04:LTS

    Versions
    • 2.5.0~preview1-1ubuntu2
    • 2.5.0-4ubuntu1
    • 2.5.0-4ubuntu4
    • 2.5.0-5ubuntu1
    • 2.5.0-6ubuntu1
    • 2.5.1-1ubuntu1
    • 2.5.1-1ubuntu1.1
    • 2.5.1-1ubuntu1.2
    • 2.5.1-1ubuntu1.4
    • 2.5.1-1ubuntu1.5
    • 2.5.1-1ubuntu1.6
    • 2.5.1-1ubuntu1.7
    • 2.5.1-1ubuntu1.8
    • 2.5.1-1ubuntu1.9
    • 2.5.1-1ubuntu1.10
    • 2.5.1-1ubuntu1.11
    • 2.5.1-1ubuntu1.12
    • 2.5.1-1ubuntu1.13
    • 2.5.1-1ubuntu1.14
    • 2.5.1-1ubuntu1.15
    • 2.5.1-1ubuntu1.16
    • 2.5.1-1ubuntu1.16+esm1
    • 2.5.1-1ubuntu1.16+esm3
    Affected ranges
    • ECOSYSTEM: < 2.5.1-1ubuntu1.16+esm4

    Update to 2.5.1-1ubuntu1.16+esm4

  • jruby Ubuntu:18.04:LTS

    Versions
    • 9.1.13.0-1
    • 9.1.17.0-1~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.7 Ubuntu:20.04:LTS

    Versions
    • 2.7.0-1
    • 2.7.0-2
    • 2.7.0-3
    • 2.7.0-4
    • 2.7.0-4ubuntu1
    • 2.7.0-5ubuntu1
    • 2.7.0-5ubuntu1.1
    • 2.7.0-5ubuntu1.2
    • 2.7.0-5ubuntu1.3
    • 2.7.0-5ubuntu1.4
    • 2.7.0-5ubuntu1.5
    • 2.7.0-5ubuntu1.6
    • 2.7.0-5ubuntu1.7
    • 2.7.0-5ubuntu1.8
    • 2.7.0-5ubuntu1.9
    • 2.7.0-5ubuntu1.10
    • 2.7.0-5ubuntu1.11
    • 2.7.0-5ubuntu1.12
    • 2.7.0-5ubuntu1.13
    • 2.7.0-5ubuntu1.14
    • 2.7.0-5ubuntu1.15
    • 2.7.0-5ubuntu1.16
    • 2.7.0-5ubuntu1.17
    Affected ranges
    • ECOSYSTEM: < 2.7.0-5ubuntu1.18

    Update to 2.7.0-5ubuntu1.18

  • jruby Ubuntu:20.04:LTS

    Versions
    • 9.1.17.0-3
    • 9.1.17.0-3build5
    • 9.1.17.0-3build6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.0 Ubuntu:22.04:LTS

    Versions
    • 3.0.2-5ubuntu1
    • 3.0.2-7
    • 3.0.2-7ubuntu2
    • 3.0.2-7ubuntu2.1
    • 3.0.2-7ubuntu2.2
    • 3.0.2-7ubuntu2.3
    • 3.0.2-7ubuntu2.4
    • 3.0.2-7ubuntu2.5
    • 3.0.2-7ubuntu2.6
    • 3.0.2-7ubuntu2.7
    • 3.0.2-7ubuntu2.8
    Affected ranges
    • ECOSYSTEM: < 3.0.2-7ubuntu2.10

    Update to 3.0.2-7ubuntu2.10

  • jruby Ubuntu:24.04:LTS

    Versions
    • 9.3.9.0+ds-1
    • 9.4.5.0+ds-1
    • 9.4.5.0+ds-1ubuntu1
    • 9.4.6.0+ds-1ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.2 Ubuntu:24.04:LTS

    Versions
    • 3.2.3-1
    • 3.2.3-1build2
    • 3.2.3-1build3
    • 3.2.3-1ubuntu0.24.04.1
    • 3.2.3-1ubuntu0.24.04.3
    Affected ranges
    • ECOSYSTEM: < 3.2.3-1ubuntu0.24.04.5

    Update to 3.2.3-1ubuntu0.24.04.5

  • jruby Ubuntu:25.10

    Versions
    • 9.4.8.0+ds-2ubuntu1
    • 9.4.8.0+ds-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.3 Ubuntu:25.10

    Affected ranges
    • ECOSYSTEM: < 3.3.7-1ubuntu2

    Update to 3.3.7-1ubuntu2

  • jruby Ubuntu:26.10

    Versions
    • 9.4.8.0+ds-3ubuntu1
    • 9.4.14.0+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jruby Ubuntu:26.04:LTS

    Versions
    • 9.4.8.0+ds-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →