Moderate Security Vulnerability in Ruby Package: CGI Denial of Service and ReDoS Issues
Summary
RLSA-2025:4487: Moderate: ruby security update. Affects ruby versions < 0:3.0.7-165.el9_5. Fixed in 0:3.0.7-165.el9_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is an extensible, interpreted, object-oriented scripting language widely used for web development and system management tasks. It offers features for processing text files and automating system operations. However, recent vulnerabilities have been identified in its CGI module, which can lead to security risks if not addressed promptly.
Vulnerability Detail
The vulnerabilities identified in Ruby's CGI module include a Regular Expression Denial of Service (ReDoS) in CGI::Util#escapeElement (CVE-2025-27220) and a Denial of Service in CGI::Cookie.parse (CVE-2025-27219). These vulnerabilities can allow an attacker to exploit the CGI functionality, potentially leading to service interruptions and degraded performance. The CVSS score for these vulnerabilities is 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
0:3.0.7-165.el9_5
This is the first release that contains the fix.
sudo dnf update rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. The best course of action is to apply the available security update as soon as possible.
Conclusion
The identified vulnerabilities in the Ruby package's CGI module pose a moderate risk to applications utilizing this functionality. It is essential to apply the necessary updates to ensure the security and stability of your systems. Regular monitoring for vulnerabilities using tools like Vulert can help maintain a secure environment.
See every vulnerability recorded for ruby →
FAQ
The vulnerabilities involve potential Denial of Service attacks through the CGI module, specifically in the escapeElement and Cookie.parse functions.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The CVSS score for these vulnerabilities is 5.3, indicating a moderate severity level.
Yes, a patch is available in version 0:3.0.7-165.el9_5 of the Ruby package. It is recommended to update to this version.
While there are no specific workarounds, it is crucial to prioritize updating the Ruby package to mitigate the risks associated with these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
