CVE-2025-27219 describes a Denial of Service (DoS) vulnerability in the CGI gem (before version 0.4.2) for Ruby, specifically within the CGI::Cookie.parse method. This flaw allows attackers to trigger excessive resource consumption by providing extremely large cookie values, as the method lacks length limitations. Rated 7.5 HIGH on the CVSS scale, this vulnerability is network-exploitable with low attack complexity, requiring no privileges or user interaction, and primarily impacts availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.3.5.1CPE matchmatch criteria | cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:* | ||
>= 0.4.0, < 0.4.2CPE matchmatch criteria | cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:* | ||
0.3.6CPE matchmatch criteria | cpe:2.3:a:ruby-lang:cgi:0.3.6:*:*:*:*:ruby:*:* | ||
>= 0, < 0.3.5.1CPE match | cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:* | ||
>= 0.3.6, < 0.3.7CPE match | cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
Mar 11, 2025CGI has Denial of Service (DoS) potential in Cookie.parse
Mar 3, 2025CGI: Denial of Service in CGI::Cookie.parse
Mar 3, 2025