CGI Gem up to 0.3.6/0.4.1 on Ruby Cookie CGI::Cookie.parse allocation of resources

Summaryinfo

A vulnerability was found in CGI Gem up to 0.3.6/0.4.1 on Ruby. It has been classified as problematic. Affected is the function CGI::Cookie.parse of the component Cookie Handler. This manipulation causes allocation of resources. The identification of this vulnerability is CVE-2025-27219. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in CGI Gem up to 0.3.6/0.4.1 on Ruby. It has been declared as problematic. Affected by this vulnerability is the function CGI::Cookie.parse of the component Cookie Handler. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. The summary by CVE is:

In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.

The advisory is shared at hackerone.com. This vulnerability is known as CVE-2025-27219 since 02/20/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 232142 (Linux Distros Unpatched Vulnerability : CVE-2025-27219), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.3.5.1, 0.3.7 or 0.4.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (232142) and EUVD (EUVD-2025-5556). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Ruby Gem

Name

• CGI Gem

Version

• 0.3.0
• 0.3.1
• 0.3.2
• 0.3.3
• 0.3.4
• 0.3.5
• 0.3.6
• 0.4.0
• 0.4.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion