CVE-2025-27219 — Vulnerability in cgi — CVE Details

MEDIUM

CGI has Denial of Service (DoS) potential in Cookie.parse

Published March 3, 2025Updated September 10, 2026Source: osv

Summary

There is a possibility for DoS by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem. ## Details CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service. Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. ## Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. ## Credits Thanks to lio346 for discovering this issue. Also thanks to mame for fixing this vulnerability.

Advisory Timeline

First published March 3, 2025 (588 days ago).
Last revised September 10, 2026 — 555 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler

Update cgi to 0.3.7 or later

gem install cgi -v 0.3.7

Bundler

Update cgi to 0.4.2 or later

gem install cgi -v 0.4.2

Bundler

Update cgi to 0.3.5.1 or later

gem install cgi -v 0.3.5.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: rubygems (1).

Package	Ecosystem	Affected	Fixed In
cgi	rubygems	0.3.6	0.3.7
cgi	rubygems	0.4.0, 0.4.1, 0.4.2.beta1, 0.4.2.beta2	0.4.2
cgi	rubygems	0.1.0, 0.1.0.1, 0.1.0.2, 0.1.1 (+9 more)	0.3.5.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-400
Uncontrolled Resource ConsumptionMITRE
CWE-770
Allocation of Resources Without LimitsMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 5.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

References

Frequently Asked Questions

What is CVE-2025-27219?: CGI has Denial of Service (DoS) potential in Cookie.parse This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 5.8/10).
How do I check if my project is affected by CVE-2025-27219?: CVE-2025-27219 affects cgi. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-27219 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

5.8

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-gh9q-2xrm-x6qv

Related CVEs

CVE-2021-41816
CRITICAL
Buffer overrun in CGI.escape_html
CVE-2021-41819
HIGH
Cookie Prefix Spoofing in CGI::Cookie.parse
CVE-2021-33621
HIGH
HTTP response splitting in CGI
CVE-2026-107715
MEDIUM
Mechanize sends credential headers to another host after an HTTP redirect
CVE-2026-107399
MEDIUM
Mechanize sends credential headers to another origin after a meta refresh
CVE-2025-27220
MEDIUM
CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement

More RubyGems advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies