CVE-2025-27219 CGI has Denial of Service (DoS) potential in Cookie.parse
An attacker can cause a denial of service by sending extremely large cookies to applications using the Ruby CGI library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-27219?
CVE-2025-27219 is a medium-severity denial of service vulnerability in ruby-lang CGI, published on 3 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
Weakness: CWE-770
Which versions are affected by CVE-2025-27219?
6 open source packages ship an affected version, including cgi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cgi RubyGems | All versions | 0.3.5.1 |
cgi RubyGems | All versions | 0.3.5.1 |
cgi RubyGems | From 0.3.6 | 0.3.7 |
cgi RubyGems | From 0.3.6 | 0.3.7 |
cgi RubyGems | From 0.4.0 | 0.4.2 |
cgi RubyGems | From 0.4.0 | 0.4.2 |
Products include Ruby-Lang Cgi.
How do I fix CVE-2025-27219?
Upgrade cgi to a fixed version for your release line: 0.3.5.1, 0.3.7 or 0.4.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-27219 being exploited?
There is no known exploitation of CVE-2025-27219 in the wild and no public exploit code.
Other vulnerabilities in ruby-lang CGI
Sources
Also known as ALPINE-CVE-2025-27219, AZL-57828, AZL-57923, CLEANSTART-2026-BY72007, CLEANSTART-2026-JU41543, DEBIAN-CVE-2025-27219 and 16 more.