Denial of Service Vulnerability in CGI Gem for Ruby: CVE-2025-27219
Summary
CVE-2025-27219: In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. Affects ruby-net-imap across 2 version ranges.
< 0.3.9-r0
< 9f7e78ece68a2cab7531d5e1111ec2e4d5344ad9
Fixed in 0.3.9-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The CGI gem is a library in Ruby that provides support for Common Gateway Interface (CGI) programming. It allows Ruby applications to handle HTTP requests and responses, making it essential for web applications. The CGI::Cookie.parse method is responsible for parsing cookie data, which is crucial for maintaining user sessions and preferences. However, prior to version 0.4.2, this method lacks safeguards against excessively large cookie values, making it vulnerable to resource exhaustion attacks.
Vulnerability Detail
CVE-2025-27219 is a Denial of Service (DoS) vulnerability found in the CGI::Cookie.parse method of the CGI gem before version 0.4.2. The vulnerability arises from the absence of limits on the length of raw cookie values processed by the method. Attackers can exploit this oversight by sending extremely large cookies, leading to excessive resource consumption and potentially crashing the application or server. This vulnerability poses a significant risk to web applications that rely on the CGI library for cookie management.
How To Fix
Minimum fixed version
0.3.9-r0
This is the first release that contains the fix.
sudo apk add --upgrade ruby-net-imapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to limit the size of cookies processed by your application. For example, you can check the length of the cookie value before parsing it and reject any cookies that exceed a predefined size limit.
Conclusion
CVE-2025-27219 presents a significant risk to applications using the CGI gem for Ruby, particularly those that do not limit cookie sizes. It is crucial to update to the patched version to mitigate this vulnerability and ensure the stability of your web applications.
See every vulnerability recorded for ruby-net-imap →
FAQ
CVE-2025-27219 is a Denial of Service vulnerability in the CGI gem for Ruby, specifically in the CGI::Cookie.parse method, which can lead to excessive resource consumption when processing large cookies.
If your application uses the CGI gem version prior to 0.4.2, it is vulnerable. You can check your application's dependencies using a manifest file like package-lock.json or use Vulert to monitor for vulnerabilities.
Exploiting this vulnerability can lead to Denial of Service attacks, causing your application or server to become unresponsive due to resource exhaustion.
Yes, the patch is available in version 0.4.2 of the CGI gem. Updating to this version will resolve the vulnerability.
You can use Vulert, which allows you to monitor and alert in real-time for open-source vulnerabilities using just a manifest file like package-lock.json. You can also check your application against vulnerabilities using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for ruby-net-imap.
