CVE-2025-27219: ruby-lang CGI · Unthrottled Resource Allocation
Affects ruby-lang CGISource CVE Database V5
Not known to be exploited · CVSS 5.8 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.8% chance of exploitation in 30 days – higher than 57% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 3 Mar 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
RubyGemscgipkg:gem/cgiOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
To mitigate CVE-2025-27219, organizations should upgrade the Ruby CGI gem to version 0.4.2 or later as soon as a patch is released. Until then, implement strict limits on HTTP request header sizes, particularly cookie header lengths, at the web server or application firewall level to prevent processing of excessively large cookies. Employ rate limiting and anomaly detection to identify and block suspicious requests with unusually large cookie values. Review and harden web application configurations to reject malformed or oversized headers. Additionally, monitor application logs for signs of resource exhaustion or abnormal request patterns indicative of attempted exploitation. Conduct security testing to verify that cookie parsing does not lead to resource overconsumption. Finally, maintain an inventory of Ruby CGI gem versions in use across the organization to prioritize patching and risk management efforts.
Description
In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.