CVE-2025-27219

Description

In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.

How to fix CVE-2025-27219

To remediate CVE-2025-27219, upgrade the affected package to a fixed version below.

• —upgrade to 3.2.8-r0 or later
• —upgrade to 0.3.9-r0 or later
• —upgrade to 2.7.4-1+deb11u5 or later
• —upgrade to 2.7.4-1+deb11u5 or later
• —no fix listed
• —upgrade to 3.3.7-2 or later
• —upgrade to 0.3.5.1 or later

Is CVE-2025-27219 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

• from 0, < 3.2.8-r0
• from 0, < 0.3.9-r0
• from 0, < 2.7.4-1+deb11u5
• from 0, < 2.7.4-1+deb11u5
• from 0
• from 0, < 3.3.7-2
• from 0, < 0.3.5.1

CVSS scores

References (11)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-27219
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2025-27219
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2025-27219
• PATCHgithub.com/ruby/cgi
• WEBgithub.com