CVE-2025-27219: ruby-lang cgi
CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2025-27219UBUNTU-CVE-2025-27219DEBIAN-CVE-2025-27219CGA-2c42-6473-pgp7CGA-2c44-4924-mwf8CGA-2r67-qp2r-x8hgCGA-2wch-x7pg-3g7gCGA-3hqm-q574-5mqcCGA-4wv5-m82j-5wr3CGA-5j4f-7pvx-fjm8CGA-5mm8-3rr3-hmxhCGA-5v45-4pqx-mvp5CGA-7hc4-vqhf-ghgxCGA-834c-5cxh-x8qxCGA-c32h-28wf-rw6mCGA-hq57-mj5v-72qwCGA-jg8w-5cf3-wm6jCGA-jr5h-gfcp-7r64CGA-jwvr-854x-7mp4CGA-m26r-crm3-694mCGA-m28v-jjgh-vhhjCGA-mmxc-mc8m-f862CGA-q3qc-mwpq-h985CGA-qr38-ph5h-9f9wCGA-r28j-v243-c662CGA-r37g-vxfx-63hgCGA-r8wj-3mjr-cxv6CGA-xfqc-gxqj-x566CGA-xqxc-8v8m-8f38CGA-2655-7h6f-prghCGA-26qh-69r7-95vfCGA-29h4-q2fw-cv2fCGA-2g8j-4ffh-pm58CGA-3q5r-4wm9-q26gCGA-4h85-w9cx-mv7pCGA-534w-fcw2-jg33CGA-58rx-chhg-xg5pCGA-5fw8-2xfp-6649CGA-5j67-mwr4-jq2gCGA-6pf3-wq99-g8c7CGA-6pjf-gg4w-ggp3CGA-6pmj-qgq9-hp39CGA-7286-hmp6-w372CGA-784j-c9f9-5r6qCGA-7q99-6fp8-5xgpCGA-869q-q6cq-4pg4CGA-8qqj-4ff8-m5g9CGA-948p-8fmj-qw9xCGA-94qc-mfp9-6j7gCGA-9jh5-xr78-92q6CGA-9vpc-79fx-wc86CGA-c26v-9whr-9h5fCGA-cjp2-vrgr-635qCGA-cvj8-xxcj-67r9CGA-f5rm-mgr9-gj48CGA-h38p-34c3-qpg8CGA-hfph-r5gv-4856CGA-j9wx-76q4-frc4CGA-mhxg-h6j2-ggw7CGA-p6m9-mwfx-wjp8CGA-prq2-4g5p-v7w5GHSA-gh9q-2xrm-x6qvCGA-q4fj-qrpg-hm3gCGA-q9fc-grpr-55jrCGA-qfq5-c55q-vmfqCGA-r3p9-8jc5-cfw9CGA-r96r-pqx3-c2hmCGA-rvp9-72mj-2rrhCGA-v285-45r3-f8f6CGA-vmcv-557q-2vprCGA-vrc2-q8rr-6mfhCGA-wpq4-7wgj-wv8p
Published 03-03-2025Last modified 03-11-2025
Vulnerability summary
CVE-2025-27219 is a high (CVSS 7.5) vulnerability in ruby-lang cgi. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.3% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.85%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 12 · Related 7Timeline
- 03-03-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
CVSS metrics
9 scores · 8 sources · 2 versionsMedium 6.3Preferred score · OSV · Rubygems (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NSourcesSingle source
High 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources8 sources · 5.8–7.5
- CVE.orgCNA5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LDiffers
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LDiffers
- OSV · RubygemsEcosystem advisory · calculated5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LDiffers
EPSS trend
Probability
0.85%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
+0.02 pp
From 0.83% on 18-09-2026
18-09-202618-10-2026
EPSS score0.85%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard33 products
- elasticsearch-8.17< 8.17.10-r13
- jruby-9.4< 9.4.14.0-r0
- jruby-9.4-default-ruby< 9.4.14.0-r0
- logstash-8-with-output-opensearchAll versions (No fix recorded)
- logstash-8.17All versions (No fix recorded)
Wolfi13 products
- jruby-9.4< 9.4.14.0-r0
- jruby-9.4-default-ruby< 9.4.14.0-r0
- logstash-8-with-output-opensearchAll versions (No fix recorded)
- ruby-3.1< 3.1.6-r12
- ruby-3.1-dev< 3.1.6-r12
Ubuntu7 products
- jrubyAll versions (No fix recorded)
- ruby2.3< 2.3.1-2~ubuntu16.04.16+esm10
- ruby2.5< 2.5.1-1ubuntu1.16+esm4
- ruby2.7< 2.7.0-5ubuntu1.18
- ruby3.0< 3.0.2-7ubuntu2.10
Alpine2 products
- ruby< 3.2.8-r0 | < 3.3.8-r0
- ruby-net-imap< 0.3.9-r0 | < 0.4.19-r0
Debian2 products
- ruby3.1All versions (No fix recorded)
- ruby3.3< 3.3.7-2
Ruby-lang1 product
- cgi≥ 0.3.6, < 0.3.7 | < 0.3.5.1 | ≥ 0.4.0, < 0.4.2 | 0.3.6
RubyGems1 product
- cgi< 0.3.5.1 | ≥ 0.3.6, < 0.3.7 | ≥ 0.4.0, < 0.4.2
7 vendors · 59 products
References
15 links- github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.ymlREPORTAdvisoryWEBThird Party Advisory
Show all 15 references
- github.com/ruby/cgiPACKAGE