Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
There is a possibility for Regular expression Denial of Service (ReDoS) by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27220. We recommend upgrading the cgi gem. Details The regular expression used in CGI::Util#escapeElement is vulnerable to ReDoS. The crafted input could lead to a high CPU consumption. This vulnerability only affects Ruby 3.1 and 3.2. If you are using these versions, please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. Credits Thanks to svalkanov for discovering this issue. Also thanks to nobu for fixing this vulnerability.
Recommended action: Upgrade to 0.4.2, 0.3.7 or 0.3.5.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a possibility for DoS by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem. Details CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service. Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later. Affected versions cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1. Credits Thanks to lio346 for discovering this issue. Also thanks to mame for fixing this vulnerability.
Recommended action: Upgrade to 0.4.2, 0.3.7 or 0.3.5.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2.
Recommended action: Upgrade to 0.3.5, 0.2.2 or 0.1.0.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby.
Recommended action: Upgrade to 0.3.1, 0.2.1 or 0.1.0.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A buffer overrun vulnerability was discovered in CGI.escapehtml. This can lead to a buffer overflow when a user passes a very large string ( 700 MB) to CGI.escapehtml on a platform where long type takes 4 bytes, typically, Windows.
Recommended action: Upgrade to 0.3.1, 0.2.1 or 0.1.0.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.