CGI has Denial of Service (DoS) potential in Cookie.parse
Résumé
CGI has Denial of Service (DoS) potential in Cookie.parse
Description d'origine
La description telle que publiée par la source (souvent en anglais).
There is a possibility for DoS by in the cgi gem.
This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem.
Details
CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service.
Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.
Affected versions
cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.
Credits
Thanks to lio346 for discovering this issue.
Also thanks to mame for fixing this vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2025-27219 ruby Corrigé dans: 3.2.8-r0
- Debian DEBIAN-CVE-2025-27219 ruby2.7 Corrigé dans: 2.7.4-1+deb11u5
- Ubuntu UBUNTU-CVE-2025-27219 jruby
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web hackerone.com
- web github.com
- web lists.debian.org
- web cve.org