VYPR
← All advisories
High severityNVD Advisory· Published Nov 18, 2022· Updated Nov 4, 2025

CVE-2021-33621

CVE-2021-33621

Description

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

HTTP response splitting vulnerability in Ruby's cgi gem allows attackers to inject malicious headers or body via untrusted user input.

Vulnerability

Overview

The cgi gem for Ruby, versions before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5, is vulnerable to HTTP response splitting [1][3]. The root cause is insufficient validation of user-supplied data when generating HTTP responses or creating CGI::Cookie objects. An attacker can inject carriage return and line feed (CRLF) sequences into the output, enabling them to split the HTTP response and inject arbitrary headers or body content [2][3].

Exploitation

Exploitation requires an application that uses untrusted user input to construct HTTP responses or CGI::Cookie objects [1]. No authentication is needed if the vulnerable endpoint is publicly accessible. The attacker can craft a malicious input containing CRLF characters, which the cgi gem fails to sanitize, leading to response splitting [3]. This attack is particularly relevant for applications that reflect user input in HTTP headers or cookie attributes.

Impact

Successful exploitation allows an attacker to perform HTTP response splitting, potentially leading to cross-site scripting (XSS), cache poisoning, or session fixation [3]. By injecting a malicious Set-Cookie header, an attacker could overwrite legitimate cookies or set arbitrary cookie attributes, compromising user sessions [2][3]. The impact is limited to applications that process untrusted input in the described manner.

Mitigation

The vulnerability is fixed in cgi gem versions 0.3.5, 0.2.2, and 0.1.0.2 [3]. Users should update to these versions or later using gem update cgi or by specifying the updated version in their Gemfile [3]. No workarounds are documented; patching is the recommended action.

References
  1. NVD - CVE-2021-33621
  2. ruby-advisory-db/gems/cgi/CVE-2021-33621.yml at master · rubysec/ruby-advisory-db
  3. CVE-2021-33621: HTTP response splitting in CGI | Ruby

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cgiRubyGems
>= 0.3.0, < 0.3.50.3.5
cgiRubyGems
>= 0.2.0, < 0.2.20.2.2
cgiRubyGems
< 0.1.0.20.1.0.2

Affected products

66

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

20

News mentions

0

No linked articles in our index yet.