Internet Bug Bounty · Report #3013913

[CVE-2025-27219] Denial of Service in CGI::Cookie.parse

Validstatus

mediumseverity

19upvotes

27 Apr 2025disclosed

Summary

There is a possibility for DoS by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem.

How it was found

Hi, I made a report in #2936778 Advisory: https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/

Details CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service.

Impact

An attacker could make a Denial of Service vulnerability that cause service disruptions and increased costs.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original