Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-41816

33
FAUCET Score

CVE-2021-41816 is a critical integer overflow and resultant buffer overflow vulnerability in CGI.escape_html affecting Ruby versions before 2.7.5 and 3.x before 3.0.3, as well as the CGI gem before 0.3.1. This flaw, particularly impactful on platforms where size_t and long differ in size, allows for remote code execution with a CVSS score of 9.8. Despite its critical severity, there is no known active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
< 0.3.1CPE matchmatch criteria
cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:*
<= 0.2.0CPE matchmatch criteria
cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:*
<= 0.1.0CPE matchmatch criteria
cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:*
34CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
35CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
4.77%
Probability of exploitation in next 30 days
EPSS Percentile
91.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0477 is in the 85th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby30-ruby-0:3.0.4-149.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-ruby27-ruby-0:2.7.6-131.el7
View patch
rubygemspatch availablevia ghsa
Product: cgiFixed in: 0.3.1
rubygemspatch availablevia ghsa
Product: cgiFixed in: 0.2.1
rubygemspatch availablevia ghsa
Product: cgiFixed in: 0.1.0.1

Vendor Advisories (2)

rubygemsGHSA-5cqm-crxm-6qpvcritical

Buffer overrun in CGI.escape_html

Dec 14, 2021
redhatCVE-2021-41816Moderate

ruby: buffer overflow in CGI.escape_html

Nov 24, 2021

References

hackerone.com / reports/1328463
Permissions RequiredThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF
security.gentoo.org / glsa/202401-27
security.netapp.com / advisory/ntap-20220303-0006
Third Party Advisory
security-tracker.debian.org / tracker/CVE-2021-41816
Third Party Advisory
ruby-lang.org / en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816
ExploitVendor Advisory