This advisory covers two security vulnerabilities in Ruby's CGI module as used in Red Hat Enterprise Linux 9. CVE-2025-27220 is a ReDoS vulnerability in the CGI::Util#escapeElement method, which could be exploited to cause resource exhaustion. CVE-2025-27219 is a denial of service vulnerability in the CGI::Cookie.parse method. Both vulnerabilities could lead to denial of service conditions. Red Hat has issued updated Ruby packages that address these issues. The advisory references Red Hat Enterprise Linux 9 and its Extended Update Support versions as affected products. No CVSS scores are provided in the advisory.

Successful exploitation of these vulnerabilities could result in denial of service conditions on affected systems running Ruby, potentially impacting availability of services that rely on Ruby's CGI processing. There is no indication of code execution or data compromise. No known exploits in the wild have been reported at this time.

Red Hat has released updated Ruby packages for Red Hat Enterprise Linux 9 and its Extended Update Support variants that fix these vulnerabilities. Users should apply the official Red Hat security update (RHSA-2025:4487) to remediate these issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.