Read the docs
TI-2025-20077 Aliases CVE-2025-27220GHSA-mhwm-jh88-3gjf

Regular expression denial of service in ruby CGI

Priority LOW 34CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0076 55th percentileScored 2026-11-07
Fix Partial CGI (ruby-lang): 0.3.5.1, 0.3.7, 0.4.2cgi (RubyGems): 0.3.5.1, 0.3.7, 0.4.2Red Hat: 3 advisoriesRed Hat: 3 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rubyCGIbefore 0.3.5.1; 0.3.6 to before 0.3.7; 0.4.0 to before 0.4.20.3.5.1, 0.3.7, 0.4.2Patch availableCNA
—cgi (RubyGems)before 0.3.5.10.3.5.1Patch availableGHSA-mhwm-jh88-3gjf
—cgi (RubyGems)0.3.6 to before 0.3.70.3.7Patch availableGHSA-mhwm-jh88-3gjf
—cgi (RubyGems)0.4.0 to before 0.4.20.4.2Patch availableGHSA-mhwm-jh88-3gjf
  • CGI Vendorruby Affected before 0.3.5.1; 0.3.6 to before 0.3.7; 0.4.0 to before 0.4.2 Fixed in 0.3.5.1, 0.3.7, 0.4.2 Patch available CNA
  • cgi (RubyGems) Vendor— Affected before 0.3.5.1 Fixed in 0.3.5.1 Patch available GHSA-mhwm-jh88-3gjf
  • cgi (RubyGems) Vendor— Affected 0.3.6 to before 0.3.7 Fixed in 0.3.7 Patch available GHSA-mhwm-jh88-3gjf
  • cgi (RubyGems) Vendor— Affected 0.4.0 to before 0.4.2 Fixed in 0.4.2 Patch available GHSA-mhwm-jh88-3gjf

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:*before 0.3.5.1; 0.4.0 to before 0.4.2Vulnerableruby
cpe:2.3:a:ruby-lang:cgi:0.3.6:*:*:*:*:ruby:*:*0.3.6Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:3.1.0:*:*:*:*:*:*:*3.1.0Running onruby
cpe:2.3:a:ruby-lang:ruby:3.2.0:*:*:*:*:*:*:*3.2.0Running onruby
  • cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:* Versions before 0.3.5.1; 0.4.0 to before 0.4.2 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:cgi:0.3.6:*:*:*:*:ruby:*:* Versions 0.3.6 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Running on ·ruby
  • cpe:2.3:a:ruby-lang:ruby:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Running on ·ruby

Remediation

  • Fix · CNA CGI (ruby-lang) Fixed in 0.3.5.1, 0.3.7, 0.4.2
  • Fix · GHSA-mhwm-jh88-3gjf cgi (RubyGems) Fixed in 0.3.5.1 Advisory →
  • Fix · GHSA-mhwm-jh88-3gjf cgi (RubyGems) Fixed in 0.3.7 Advisory →
  • Fix · GHSA-mhwm-jh88-3gjf cgi (RubyGems) Fixed in 0.4.2 Advisory →

Red Hat 3 advisories

  • RHSA-2025:4488 Released 2025-05-06 · Red Hat rating Moderate
    ruby:3.1 security update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-3.1.7-146.module+el9.5.0+23003+a4c328ce.aarch64::ruby:3.1, ruby-3.1.7-146.module+el9.5.0+23003+a4c328ce.i686::ruby:3.1, ruby-3.1.7-146.module+el9.5.0+23003+a4c328ce.ppc64le::ruby:3.1 +47
  • RHSA-2025:4487 Released 2025-05-06 · Red Hat rating Moderate
    ruby security update
    • Red Hat CodeReady Linux Builder (v. 9) ruby-doc-3.0.7-165.el9_5
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-3.0.7-165.el9_5, ruby-default-gems-3.0.7-165.el9_5, ruby-devel-3.0.7-165.el9_5 +18
  • RHSA-2025:4063 Released 2025-04-23 · Red Hat rating Moderate
    ruby:3.1 security update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-3.1.7-145.module+el8.10.0+23011+f9d508f8.aarch64::ruby:3.1, ruby-3.1.7-145.module+el8.10.0+23011+f9d508f8.i686::ruby:3.1, ruby-3.1.7-145.module+el8.10.0+23011+f9d508f8.ppc64le::ruby:3.1 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ruby-lang CGI 0.3.5.1, 0.3.7, 0.4.2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-20076 Resource allocation without limits in ruby CGIPriority LOW 34
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2025:4487
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:4063
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:4487, RHSA-2025:4488
Not affected: 2 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27220
  2. 2026-10-03 Alias added: GHSA-mhwm-jh88-3gjf

References

Advisory 2

Other 8

  • TI-2021-18442 CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and… CVSS 3.1CRITICAL 9.8
  • TI-2021-12996 The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows… CVSS 3.1HIGH 8.8
  • TI-2021-18444 CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. CVSS 3.1HIGH 7.5
  • TI-2025-20076 Resource allocation without limits in ruby CGI CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences