PatchTheCVEcgi vulnerabilities and fixes
Recent CVEs affecting cgi, with upgrade or downgrade steps. 2 tracked.
cgi has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-03-04. Highest priority: CVE-2025-27219 (score 40/100).
- CVE-2025-27220 MEDIUM 4.0 UPGRADE In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in t
- CVE-2025-27219 MEDIUM 5.8 UPGRADE In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Den
FAQ
How do I fix cgi vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is cgi being exploited right now?
None of the tracked cgi CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which cgi CVE should I patch first?
CVE-2025-27219 currently ranks highest (40/100): In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Den.