Summary
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.
Security Fix(es):
* CGI: ReDoS in CGI::Util#escapeElement (CVE-2025-27220)
* CGI: Denial of Service in CGI::Cookie.parse (CVE-2025-27219)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | ruby | 0:3.0.7-165.el9_5 |
Vulnerabilities 2
-
Medium 5.8
CGI has Denial of Service (DoS) potential in Cookie.parse
In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead …
-
Medium 4.0
CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement
In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.