Package Instance

CVE-2025-27219 - Denial of Service in CGI::Cookie.parse
There is a possibility for DoS by in the cgi gem.
This vulnerability has been assigned the CVE identifier
CVE-2025-27219. We recommend upgrading the cgi gem.

## Details

CGI::Cookie.parse took super-linear time to parse a cookie string
in some cases. Feeding a maliciously crafted cookie string into
the method could lead to a Denial of Service.

Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.

## Affected versions

cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.

## Credits

Thanks to lio346 for discovering this issue.
Also thanks to mame for fixing this vulnerability.

CVE-2025-27220 - ReDoS in CGI::Util#escapeElement.
There is a possibility for Regular expression Denial of Service (ReDoS)
by in the cgi gem. This vulnerability has been assigned the CVE
identifier CVE-2025-27220. We recommend upgrading the cgi gem.

## Details

The regular expression used in CGI::Util#escapeElement is vulnerable
to ReDoS. The crafted input could lead to a high CPU consumption.

This vulnerability only affects Ruby 3.1 and 3.2. If you
are using these versions, please update CGI gem to version
0.3.5.1, 0.3.7, 0.4.2 or later.

## Affected versions

cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.

## Credits

Thanks to svalkanov for discovering this issue.
Also thanks to nobu for fixing this vulnerability.

HTTP response splitting in CGI
If an application that generates HTTP responses using the cgi gem with untrusted user input, an attacker can exploit it to inject a malicious HTTP response header and/or body.

Also, the contents for a CGI::Cookie object were not checked properly. If an application creates a CGI::Cookie object based on user input, an attacker may exploit it to inject invalid attributes in Set-Cookie header. We think such applications are unlikely, but we have included a change to check arguments for CGI::Cookie#initialize preventatively.