CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names.
Priority LOW 39CWE-565Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 7 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03151 88th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial cgi (RubyGems): 0.3.1, 0.2.1, 0.1.0.1Red Hat: 13 advisoriesRed Hat: 7 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | cgi (RubyGems) | 0.3.0 to before 0.3.1 | 0.3.1 | Patch available | GHSA-4vf4-qmvg-mh7h |
| — | cgi (RubyGems) | 0.2.0 to before 0.2.1 | 0.2.1 | Patch available | GHSA-4vf4-qmvg-mh7h |
| — | cgi (RubyGems) | before 0.1.0.1 | 0.1.0.1 | Patch available | GHSA-4vf4-qmvg-mh7h |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- cgi (RubyGems) Vendor— Affected 0.3.0 to before 0.3.1 Fixed in 0.3.1 Patch available GHSA-4vf4-qmvg-mh7h
- cgi (RubyGems) Vendor— Affected 0.2.0 to before 0.2.1 Fixed in 0.2.1 Patch available GHSA-4vf4-qmvg-mh7h
- cgi (RubyGems) Vendor— Affected before 0.1.0.1 Fixed in 0.1.0.1 Patch available GHSA-4vf4-qmvg-mh7h
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ruby-lang:cgi:0.1.0:*:*:*:*:ruby:*:* | 0.1.0 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:cgi:0.2.0:*:*:*:*:ruby:*:* | 0.2.0 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:cgi:0.3.0:*:*:*:*:ruby:*:* | 0.3.0 | Vulnerable | ruby |
| cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* | up to 2.6.8; 2.7.0 to before 2.7.5; 3.0.0 to before 3.0.3 | Vulnerable | ruby |
| cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:suse:linux_enterprise:11.0:sp1:*:*:*:*:*:* | 11.0 sp1 | Vulnerable | SUSE |
- cpe:2.3:a:ruby-lang:cgi:0.1.0:*:*:*:*:ruby:*:* Versions 0.1.0 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:cgi:0.2.0:*:*:*:*:ruby:*:* Versions 0.2.0 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:cgi:0.3.0:*:*:*:*:ruby:*:* Versions 0.3.0 Vulnerable ·ruby
- cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* Versions up to 2.6.8; 2.7.0 to before 2.7.5; 3.0.0 to before 3.0.3 Vulnerable ·ruby
- cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:suse:linux_enterprise:11.0:sp1:*:*:*:*:*:* Versions 11.0 sp1 Vulnerable ·SUSE
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | SUSE |
| cpe:2.3:a:opensuse:factory:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | 15.2 | Vulnerable | openSUSE |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
- cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·SUSE
- cpe:2.3:a:opensuse:factory:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-4vf4-qmvg-mh7h cgi (RubyGems) Fixed in 0.3.1 Advisory →
- Fix · GHSA-4vf4-qmvg-mh7h cgi (RubyGems) Fixed in 0.2.1 Advisory →
- Fix · GHSA-4vf4-qmvg-mh7h cgi (RubyGems) Fixed in 0.1.0.1 Advisory →
Red Hat 13 advisories
- RHSA-2026:8838 Released 2026-04-17 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images ruby4.0-4.0.0-33.3.hum1@aarch64, ruby4.0-4.0.0-33.3.hum1@src, ruby4.0-4.0.0-33.3.hum1@x86_64 +10
- RHSA-2026:7307 Released 2026-04-09 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images ruby3.4-3.4.8-31.1.hum1@aarch64, ruby3.4-3.4.8-31.1.hum1@src, ruby3.4-3.4.8-31.1.hum1@x86_64 +10
- RHSA-2026:7305 Released 2026-04-09 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images ruby3.3-3.3.10-23.1.hum1@aarch64, ruby3.3-3.3.10-23.1.hum1@src, ruby3.3-3.3.10-23.1.hum1@x86_64 +10
Show 10 more Red Hat advisories
- RHSA-2022:6856 Released 2022-10-11 · Red Hat rating Moderaterh-ruby27-ruby security, bug fix, and enhancement update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-ruby27-ruby-2.7.6-131.el7, rh-ruby27-ruby-devel-2.7.6-131.el7, rh-ruby27-ruby-doc-2.7.6-131.el7 +19
- Red Hat Software Collections for RHEL(v. 7) rh-ruby27-ruby-2.7.6-131.el7, rh-ruby27-ruby-devel-2.7.6-131.el7, rh-ruby27-ruby-doc-2.7.6-131.el7 +19
- RHSA-2022:6855 Released 2022-10-11 · Red Hat rating Moderaterh-ruby30-ruby security, bug fix, and enhancement update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-ruby30-ruby-3.0.4-149.el7, rh-ruby30-ruby-default-gems-3.0.4-149.el7, rh-ruby30-ruby-devel-3.0.4-149.el7 +18
- Red Hat Software Collections for RHEL(v. 7) rh-ruby30-ruby-3.0.4-149.el7, rh-ruby30-ruby-default-gems-3.0.4-149.el7, rh-ruby30-ruby-devel-3.0.4-149.el7 +18
- RHSA-2022:6450 Released 2022-09-13 · Red Hat rating Moderateruby:3.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) ruby-3.0.4-141.module+el8.6.0+16311+3e5e17e9.aarch64::ruby:3.0, ruby-3.0.4-141.module+el8.6.0+16311+3e5e17e9.i686::ruby:3.0, ruby-3.0.4-141.module+el8.6.0+16311+3e5e17e9.ppc64le::ruby:3.0 +47
- RHSA-2022:6447 Released 2022-09-13 · Red Hat rating Moderateruby:2.7 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) ruby-2.7.6-138.module+el8.6.0+16148+54b2ba8f.aarch64::ruby:2.7, ruby-2.7.6-138.module+el8.6.0+16148+54b2ba8f.i686::ruby:2.7, ruby-2.7.6-138.module+el8.6.0+16148+54b2ba8f.ppc64le::ruby:2.7 +47
- RHSA-2022:5779 Released 2022-08-01 · Red Hat rating Moderateruby:2.5 security update
- Red Hat Enterprise Linux AppStream (v. 8) ruby-2.5.9-110.module+el8.6.0+15956+aa803fc1.aarch64::ruby:2.5, ruby-2.5.9-110.module+el8.6.0+15956+aa803fc1.i686::ruby:2.5, ruby-2.5.9-110.module+el8.6.0+15956+aa803fc1.ppc64le::ruby:2.5 +47
- RHSA-2022:0708 Released 2022-02-28 · Red Hat rating Importantrh-ruby26-ruby security, bug fix, and enhancement update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-ruby26-ruby-2.6.9-120.el7, rh-ruby26-ruby-devel-2.6.9-120.el7, rh-ruby26-ruby-doc-2.6.9-120.el7 +18
- Red Hat Software Collections for RHEL(v. 7) rh-ruby26-ruby-2.6.9-120.el7, rh-ruby26-ruby-devel-2.6.9-120.el7, rh-ruby26-ruby-doc-2.6.9-120.el7 +18
- RHSA-2022:0582 Released 2022-02-21 · Red Hat rating Importantruby:2.6 security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) ruby-2.6.9-107.module+el8.2.0+14086+86d863af.aarch64::ruby:2.6, ruby-2.6.9-107.module+el8.2.0+14086+86d863af.i686::ruby:2.6, ruby-2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le::ruby:2.6 +47
- RHSA-2022:0581 Released 2022-02-21 · Red Hat rating Importantruby:2.6 security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.1) ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.i686::ruby:2.6, ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.ppc64le::ruby:2.6, ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.src::ruby:2.6 +47
- RHSA-2022:0544 Released 2022-02-16 · Red Hat rating Importantruby:2.6 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.4) ruby-2.6.9-108.module+el8.4.0+14070+b3717926.aarch64::ruby:2.6, ruby-2.6.9-108.module+el8.4.0+14070+b3717926.i686::ruby:2.6, ruby-2.6.9-108.module+el8.4.0+14070+b3717926.ppc64le::ruby:2.6 +47
- RHSA-2022:0543 Released 2022-02-16 · Red Hat rating Importantruby:2.6 security update
- Red Hat Enterprise Linux AppStream (v. 8) ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.aarch64::ruby:2.6, ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.i686::ruby:2.6, ruby-2.6.9-108.module+el8.5.0+13719+08a8ba32.ppc64le::ruby:2.6 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:0543, RHSA-2022:5779, RHSA-2022:6447, RHSA-2022:6450 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.1) | Fixed | RHSA-2022:0581 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.2) | Fixed | RHSA-2022:0582 |
| Red Hat Enterprise Linux AppStream EUS (v.8.4) | Fixed | RHSA-2022:0544 |
| Red Hat Hardened Images | Fixed | RHSA-2026:7305, RHSA-2026:7307, RHSA-2026:8838 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2022:0708, RHSA-2022:6855, RHSA-2022:6856 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2022:0708, RHSA-2022:6855, RHSA-2022:6856 |
Not affected: 1 product
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41819
- 2026-10-03 Alias added: GHSA-4vf4-qmvg-mh7h
References
Advisory 6
Other 8
- https://github.com/ruby/cgi
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2021-41819.yml
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF
- https://lists.fedoraproject.org/archives/list/[email protected]/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN
- https://lists.fedoraproject.org/archives/list/[email protected]/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF
- https://security.netapp.com/advisory/ntap-20220121-0003
- https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819
Sources
- CVE-2021-41819 · CVE Program
- CVE-2021-41819 · NVD
- FIRST EPSS
- GHSA-4vf4-qmvg-mh7h · GitHub Advisory Database · CC BY 4.0
- CVE-2021-41819 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences