VYPR
← All advisories
Critical severityNVD Advisory· Published Feb 6, 2022· Updated Aug 4, 2024

CVE-2021-41816

CVE-2021-41816

Description

CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Integer overflow in CGI.escape_html in Ruby before 2.7.5/3.0.3 leads to buffer overflow on platforms where size_t and long differ.

Vulnerability

CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3, as well as the CGI gem before 0.3.1, contains an integer overflow vulnerability [1]. On platforms where size_t and long have different byte sizes (e.g., Windows), a long string passed to CGI.escape_html can cause an integer overflow in the length calculation, resulting in a buffer overflow [2][3][4].

Exploitation

An attacker can provide a specially crafted long string to an application that uses CGI.escape_html. No special authentication is required if the application processes user-supplied input through this method. The overflow occurs during the internal buffer allocation when the computed length wraps around due to integer overflow [2][3][4].

Impact

Successful exploitation can lead to a buffer overflow, potentially allowing an attacker to corrupt memory and achieve arbitrary code execution or cause a denial of service. The impact depends on the context of the application using the vulnerable function [1].

Mitigation

The vulnerability is fixed in Ruby versions 2.7.5 and 3.0.3, and in CGI gem version 0.3.1 [1]. Users should upgrade to these versions or later. No workaround is available other than upgrading. The issue was reported via HackerOne [1].

References
  1. NVD - CVE-2021-41816
  2. Fix integer overflow · ruby/cgi@c6a37a6
  3. Fix integer overflow · ruby/cgi@959ccf0
  4. Fix integer overflow · ruby/cgi@c728632

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cgiRubyGems
>= 0.3.0, < 0.3.10.3.1
cgiRubyGems
>= 0.2.0, < 0.2.10.2.1
cgiRubyGems
< 0.1.0.10.1.0.1

Affected products

15

Patches

4
ad079c1cb5f5

merge some parts of CGI 0.1.1

https://github.com/ruby/cgiNAKAMURA UsakuNov 24, 2021via ghsa
commit
4 files changed · +8 −3
  • ext/cgi/escape/escape.c+2 −1 modified
    @@ -36,7 +36,8 @@ static VALUE
 optimized_escape_html(VALUE str)
 {
     VALUE vbuf;
-    char *buf = ALLOCV_N(char, vbuf, RSTRING_LEN(str) * HTML_ESCAPE_MAX_LEN);
+    typedef char escape_buf[HTML_ESCAPE_MAX_LEN];
+    char *buf = *ALLOCV_N(escape_buf, vbuf, RSTRING_LEN(str));
     const char *cstr = RSTRING_PTR(str);
     const char *end = cstr + RSTRING_LEN(str);
  • lib/cgi/cookie.rb+0 −1 modified
    @@ -159,7 +159,6 @@ def self.parse(raw_cookie)
       raw_cookie.split(/;\s?/).each do |pairs|
         name, values = pairs.split('=',2)
         next unless name and values
-        name = CGI.unescape(name)
         values ||= ""
         values = values.split('&').collect{|v| CGI.unescape(v,@@accept_charset) }
         if cookies.has_key?(name)
  • lib/cgi/version.rb+1 −1 modified
    @@ -1,3 +1,3 @@
 class CGI
-  VERSION = "0.1.0"
+  VERSION = "0.1.0.1"
 end
  • test/cgi/test_cgi_cookie.rb+5 −0 modified
    @@ -101,6 +101,11 @@ def test_cgi_cookie_parse
     end
   end
 
+  def test_cgi_cookie_parse_not_decode_name
+    cookie_str = "%66oo=baz;foo=bar"
+    cookies = CGI::Cookie.parse(cookie_str)
+    assert_equal({"%66oo" => ["baz"], "foo" => ["bar"]}, cookies)
+  end
 
   def test_cgi_cookie_arrayinterface
     cookie = CGI::Cookie.new('name1', 'a', 'b', 'c')
959ccf0b6a67

Fix integer overflow

https://github.com/ruby/cgiNobuyoshi NakadaSep 3, 2021via ghsa
commit
1 file changed · +2 −1
  • ext/cgi/escape/escape.c+2 −1 modified
    @@ -38,7 +38,8 @@ static VALUE
 optimized_escape_html(VALUE str)
 {
     VALUE vbuf;
-    char *buf = ALLOCV_N(char, vbuf, RSTRING_LEN(str) * HTML_ESCAPE_MAX_LEN);
+    typedef char escape_buf[HTML_ESCAPE_MAX_LEN];
+    char *buf = *ALLOCV_N(escape_buf, vbuf, RSTRING_LEN(str));
     const char *cstr = RSTRING_PTR(str);
     const char *end = cstr + RSTRING_LEN(str);
c728632c1c09

Fix integer overflow

https://github.com/ruby/cgiNobuyoshi NakadaSep 3, 2021via ghsa
commit
1 file changed · +2 −1
  • ext/cgi/escape/escape.c+2 −1 modified
    @@ -36,7 +36,8 @@ static VALUE
 optimized_escape_html(VALUE str)
 {
     VALUE vbuf;
-    char *buf = ALLOCV_N(char, vbuf, RSTRING_LEN(str) * HTML_ESCAPE_MAX_LEN);
+    typedef char escape_buf[HTML_ESCAPE_MAX_LEN];
+    char *buf = *ALLOCV_N(escape_buf, vbuf, RSTRING_LEN(str));
     const char *cstr = RSTRING_PTR(str);
     const char *end = cstr + RSTRING_LEN(str);
c6a37a671b55

Fix integer overflow

https://github.com/ruby/cgiNobuyoshi NakadaSep 3, 2021via ghsa
commit
1 file changed · +2 −1
  • ext/cgi/escape/escape.c+2 −1 modified
    @@ -36,7 +36,8 @@ static VALUE
 optimized_escape_html(VALUE str)
 {
     VALUE vbuf;
-    char *buf = ALLOCV_N(char, vbuf, RSTRING_LEN(str) * HTML_ESCAPE_MAX_LEN);
+    typedef char escape_buf[HTML_ESCAPE_MAX_LEN];
+    char *buf = *ALLOCV_N(escape_buf, vbuf, RSTRING_LEN(str));
     const char *cstr = RSTRING_PTR(str);
     const char *end = cstr + RSTRING_LEN(str);

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

21

News mentions

0

No linked articles in our index yet.