Skip to content
Log inStart free trial

GHSA-4vf4-qmvg-mh7h BIT-ruby-2021-41819 BIT-ruby-min-2021-41819 CVE-2021-41819

Cookie Prefix Spoofing in CGI::Cookie.parse

High RubyGems
Severity
7.5 / 10
High · CVSS 3.1
Exploit chance (EPSS)
3.15%
Chance of exploitation in the next 30 days. Higher than 87.95% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-565 Reliance on Cookies without Validation and Integrity Checking
Fix
0.3.1
Upgrade cgi to this version or later

Description

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby.

Affected versions

RubyGems

PackageVulnerableFixed in
cgi
>= 0.3.0, < 0.3.1
0.3.1
cgi
>= 0.2.0, < 0.2.1
0.2.1
cgi
< 0.1.0.1
0.1.0.1

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

cgi RubyGems → 0.3.1

bundler
bundle update cgi # Gemfile: gem "cgi", ">= 0.3.1"

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Weakness

CWE-565: Reliance on Cookies without Validation and Integrity Checking

The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

How to prevent it
  • Architecture and Design: Avoid using cookie data for a security-related decision.
  • Implementation: Perform thorough input validation (i.e.: server side validation) on the cookie data if you're going to use it for a security related decision.
  • Architecture and Design: Add integrity checks to detect tampering.
  • Architecture and Design: Protect critical cookies from replay attacks, since cross-site scripting or other attacks may allow attackers to steal a strongly-encrypted cookie that also passes integrity checks. This mitigation applies to cookies that should only be valid during a single transaction or session. By enforcing timeouts, you may limit the scope of an attack. As part of your integrity check, use an unpredictable, server-side value that is not exposed to the client.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-mhwm-jh88-3gjf
CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement
High Also affects cgi
GHSA-gh9q-2xrm-x6qv
CGI has Denial of Service (DoS) potential in Cookie.parse
High Also affects cgi
GHSA-vc47-6rqg-c7f5
HTTP response splitting in CGI
High Also affects cgi
GHSA-5cqm-crxm-6qpv
Buffer overrun in CGI.escape_html
Critical Also affects cgi
GHSA-gx76-c99x-2c96
AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
Low Same weakness, CWE-565
EEF-CVE-2026-75757
AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain
Not rated yet Same weakness, CWE-565
GHSA-8c7c-h7px-267g
Concrete CMS is vulnerable to IDOR in surveys
Medium Same weakness, CWE-565
CVE-2026-0257
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security…
High Known exploited Same weakness, CWE-565
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor