CVE-2025-27220 — Vulnerability in cgi — CVE Details

MEDIUM

CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement

Published March 3, 2025Updated September 10, 2026Source: osv

Summary

There is a possibility for Regular expression Denial of Service (ReDoS) by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27220. We recommend upgrading the cgi gem. ## Details The regular expression used in `CGI::Util#escapeElement` is vulnerable to ReDoS. The crafted input could lead to a high CPU consumption. This vulnerability only affects Ruby 3.1 and 3.2. If you are using these versions, please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. ## Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. ## Credits Thanks to svalkanov for discovering this issue. Also thanks to nobu for fixing this vulnerability.

Advisory Timeline

First published March 3, 2025 (588 days ago).
Last revised September 10, 2026 — 555 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler

Update cgi to 0.3.7 or later

gem install cgi -v 0.3.7

Bundler

Update cgi to 0.4.2 or later

gem install cgi -v 0.4.2

Bundler

Update cgi to 0.3.5.1 or later

gem install cgi -v 0.3.5.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: rubygems (1).

Package	Ecosystem	Affected	Fixed In
cgi	rubygems	0.3.6	0.3.7
cgi	rubygems	0.4.0, 0.4.1, 0.4.2.beta1, 0.4.2.beta2	0.4.2
cgi	rubygems	0.1.0, 0.1.0.1, 0.1.0.2, 0.1.1 (+9 more)	0.3.5.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-1333
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 4.0 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

Low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L

References

Frequently Asked Questions

What is CVE-2025-27220?: CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 4.0/10).
How do I check if my project is affected by CVE-2025-27220?: CVE-2025-27220 affects cgi. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-27220 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

4.0

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-mhwm-jh88-3gjf

Related CVEs

CVE-2021-41816
CRITICAL
Buffer overrun in CGI.escape_html
CVE-2021-41819
HIGH
Cookie Prefix Spoofing in CGI::Cookie.parse
CVE-2021-33621
HIGH
HTTP response splitting in CGI
CVE-2026-107715
MEDIUM
Mechanize sends credential headers to another host after an HTTP redirect
CVE-2026-107399
MEDIUM
Mechanize sends credential headers to another origin after a meta refresh
CVE-2025-27219
MEDIUM
CGI has Denial of Service (DoS) potential in Cookie.parse

More RubyGems advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies