VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 3, 2025· Updated Nov 3, 2025

CVE-2025-27219

CVE-2025-27219

Description

In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CGI::Cookie.parse in Ruby's CGI gem before 0.4.2 lacks a length limit, leading to a denial of service via resource exhaustion.

Vulnerability

The CGI gem for Ruby, versions prior to 0.4.2, contains a denial of service vulnerability in the CGI::Cookie.parse method. The method does not enforce any limit on the length of the raw cookie value it processes, allowing an attacker to send an extremely large cookie value. This lack of input size validation can cause excessive memory and CPU consumption during parsing [1][2][3][4].

Attack

Vector

The vulnerability is remotely exploitable without authentication. An attacker can craft a simple HTTP request containing an oversized cookie header. When the target application using the CGI gem processes this request, the CGI::Cookie.parse method will attempt to handle the arbitrarily large cookie value, consuming server resources [4].

Impact

Successful exploitation leads to a denial of service condition. The excessive resource consumption can slow down or crash the server, making the application unavailable to legitimate users [4].

Mitigation

The issue is fixed in CGI gem version 0.4.2. Users should upgrade to this version or later. For versions 0.3.x and 0.3.5.x, pull requests have been merged to address the issue, and backport fixes are available [1][2][3].

References
  1. Fix escapeElement and CGI::Cookie.parse for v0.3.5.x by hsbt · Pull Request #54 · ruby/cgi
  2. Fix escapeElement and CGI::Cookie.parse for v0.3.x by hsbt · Pull Request #53 · ruby/cgi
  3. Fix escapeElement and CGI::Cookie.parse by hsbt · Pull Request #52 · ruby/cgi
  4. NVD - CVE-2025-27219

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cgiRubyGems
< 0.3.5.10.3.5.1
cgiRubyGems
>= 0.3.6, < 0.3.70.3.7
cgiRubyGems
>= 0.4.0, < 0.4.20.4.2

Affected products

87

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.