Search for vulnerabilities
Vulnerability details: VCID-ey82-nbah-9bfr
Vulnerability ID VCID-ey82-nbah-9bfr
Aliases CVE-2025-27219
GHSA-gh9q-2xrm-x6qv
Summary CGI has Denial of Service (DoS) potential in Cookie.parse There is a possibility for DoS by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem. ## Details CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service. Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. ## Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. ## Credits Thanks to lio346 for discovering this issue. Also thanks to mame for fixing this vulnerability.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-400 Uncontrolled Resource Consumption
CWE-770 Allocation of Resources Without Limits or Throttling
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27219.json
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2025-27219
epss 0.0035 https://api.first.org/data/v1/epss?cve=CVE-2025-27219
epss 0.0035 https://api.first.org/data/v1/epss?cve=CVE-2025-27219
epss 0.0035 https://api.first.org/data/v1/epss?cve=CVE-2025-27219
epss 0.0035 https://api.first.org/data/v1/epss?cve=CVE-2025-27219
epss 0.0035 https://api.first.org/data/v1/epss?cve=CVE-2025-27219
epss 0.0035 https://api.first.org/data/v1/epss?cve=CVE-2025-27219
epss 0.0035 https://api.first.org/data/v1/epss?cve=CVE-2025-27219
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-gh9q-2xrm-x6qv
cvssv3.1 5.8 https://github.com/ruby/cgi
generic_textual MODERATE https://github.com/ruby/cgi
cvssv3.1 5.8 https://github.com/ruby/cgi/pull/52
generic_textual MODERATE https://github.com/ruby/cgi/pull/52
cvssv3.1 5.8 https://github.com/ruby/cgi/pull/53
generic_textual MODERATE https://github.com/ruby/cgi/pull/53
cvssv3.1 5.8 https://github.com/ruby/cgi/pull/54
generic_textual MODERATE https://github.com/ruby/cgi/pull/54
cvssv3.1 5.8 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml
ssvc Track https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml
cvssv3.1 5.8 https://hackerone.com/reports/2936778
generic_textual MODERATE https://hackerone.com/reports/2936778
ssvc Track https://hackerone.com/reports/2936778
cvssv3.1 5.8 https://nvd.nist.gov/vuln/detail/CVE-2025-27219
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2025-27219
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-27219
cvssv3 5.8 https://www.cve.org/CVERecord?id=CVE-2025-27219
cvssv3.1 5.8 https://www.cve.org/CVERecord?id=CVE-2025-27219
generic_textual MODERATE https://www.cve.org/CVERecord?id=CVE-2025-27219
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27219.json
https://api.first.org/data/v1/epss?cve=CVE-2025-27219
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27219
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/ruby/cgi
https://github.com/ruby/cgi/pull/52
https://github.com/ruby/cgi/pull/53
https://github.com/ruby/cgi/pull/54
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml
https://hackerone.com/reports/2936778
https://nvd.nist.gov/vuln/detail/CVE-2025-27219
https://www.cve.org/CVERecord?id=CVE-2025-27219
1103792 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103792
2349699 https://bugzilla.redhat.com/show_bug.cgi?id=2349699
cpe:2.3:a:ruby-lang:cgi:0.3.6:*:*:*:*:ruby:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:cgi:0.3.6:*:*:*:*:ruby:*:*
cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:*
GHSA-gh9q-2xrm-x6qv https://github.com/advisories/GHSA-gh9q-2xrm-x6qv
RHSA-2025:10217 https://access.redhat.com/errata/RHSA-2025:10217
RHSA-2025:4063 https://access.redhat.com/errata/RHSA-2025:4063
RHSA-2025:4487 https://access.redhat.com/errata/RHSA-2025:4487
RHSA-2025:4488 https://access.redhat.com/errata/RHSA-2025:4488
RHSA-2025:4493 https://access.redhat.com/errata/RHSA-2025:4493
RHSA-2025:8131 https://access.redhat.com/errata/RHSA-2025:8131
USN-7418-1 https://usn.ubuntu.com/7418-1/
USN-7442-1 https://usn.ubuntu.com/7442-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27219.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Found at https://github.com/ruby/cgi
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Found at https://github.com/ruby/cgi/pull/52
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Found at https://github.com/ruby/cgi/pull/53
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Found at https://github.com/ruby/cgi/pull/54
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:41:05Z/ Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Found at https://hackerone.com/reports/2936778
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:41:05Z/ Found at https://hackerone.com/reports/2936778
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2025-27219
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-27219
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Found at https://www.cve.org/CVERecord?id=CVE-2025-27219
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.38081
EPSS Score 0.00163
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:12:42.979297+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-gh9q-2xrm-x6qv/GHSA-gh9q-2xrm-x6qv.json 36.1.3