VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 3, 2025· Updated Nov 3, 2025

CVE-2025-27220

CVE-2025-27220

Description

In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Ruby CGI gem before 0.4.2 has a ReDoS in Util#escapeElement, allowing CPU exhaustion via crafted input.

The CGI gem for Ruby, versions prior to 0.4.2, contains a Regular Expression Denial of Service (ReDoS) vulnerability in the Util#escapeElement method. This flaw arises from a regex pattern that can exhibit catastrophic backtracking when processing specially crafted strings [1][4]. The affected method is used to escape HTML elements and is part of the CGI utility functions.

Exploitation

An attacker can trigger the ReDoS by providing a maliciously crafted input string to any application that uses Util#escapeElement on untrusted data. No authentication is required if the input is exposed through a public endpoint. The regex engine will consume excessive CPU resources, potentially leading to a denial of service [2][3].

Impact

Successful exploitation results in high CPU usage, which can slow down or halt the Ruby process. This can make the application unresponsive, affecting availability. In multi-threaded or multi-process environments, it can also impact other services running on the same system. The vulnerability is classified with an unknown CVSS vector but has a high availability impact [4].

Mitigation

The vulnerability is fixed in CGI gem version 0.4.2. Users should upgrade to this version or later (0.4.2.x or newer). The fix involved refactoring the regex to avoid catastrophic backtracking [1][2][3]. No workarounds are documented; upgrading is the recommended action.

References
  1. Fix escapeElement and CGI::Cookie.parse for v0.3.5.x by hsbt · Pull Request #54 · ruby/cgi
  2. Fix escapeElement and CGI::Cookie.parse for v0.3.x by hsbt · Pull Request #53 · ruby/cgi
  3. Fix escapeElement and CGI::Cookie.parse by hsbt · Pull Request #52 · ruby/cgi
  4. NVD - CVE-2025-27220

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cgiRubyGems
< 0.3.5.10.3.5.1
cgiRubyGems
>= 0.3.6, < 0.3.70.3.7
cgiRubyGems
>= 0.4.0, < 0.4.20.4.2

Affected products

86

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.