PT-2025-8694 · Unknown+9 · Cgi::Cookie+9
Lio346
·
Published
2025-02-26
·
Updated
2025-11-26
·
CVE-2025-27219
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
CGI gem versions prior to 0.4.2
Description
The CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes, leading to excessive resource consumption when parsing extremely large cookies.
Recommendations
For CGI gem versions prior to 0.4.2, update the CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later to resolve the issue. As a temporary workaround, consider restricting the size of cookie values to prevent excessive resource consumption.
Exploit
Fix
DoS
Allocation of Resources Without Limits
RCE
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Cgi::Cookie
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu