{"id":"CVE-2021-41816","aliases":["ALPINE-CVE-2021-41816","BELL-CVE-2021-41816","DEBIAN-CVE-2021-41816","DSA-5067-1","EUVD-2021-2447","GHSA-5cqm-crxm-6qpv","MGASA-2021-0579","RHSA-2022:6855","RHSA-2022:6856","UBUNTU-CVE-2021-41816","USN-5235-1","openSUSE-SU-2024:11657-1","openSUSE-SU-2024:11658-1","openSUSE-SU-2024:11786-1","openSUSE-SU-2024:12712-1","openSUSE-SU-2024:13623-1","openSUSE-SU-2025:14621-1","openSUSE-SU-2025:15819-1"],"status":"published","title":"Buffer overrun in CGI.escape_html","description":"CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.04898,"percentile":0.92162,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2021-12-02T00:00:00Z","modified":"2026-10-24T10:30:25Z","fixes":[{"ecosystem":"RubyGems","package":"cgi","fixed_in":["0.3.1","0.2.1","0.1.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.12","package":"ruby","fixed_in":["2.7.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"ruby","fixed_in":["2.7.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"ruby","fixed_in":["2.7.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"ruby","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"ruby","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"ruby","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"ruby","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"ruby","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"ruby","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ruby","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ruby","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ruby","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ruby","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"ruby2.7","fixed_in":["2.7.4-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"ruby2.7","fixed_in":["2.7.0-5ubuntu1.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ruby3.0","fixed_in":["3.0.2-7ubuntu2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"cgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.3.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"cgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0"},{"fixed":"0.2.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"cgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-1+deb11u1"}]}],"versions":["2.7.4-1"]},{"source":"osv","ecosystem":"Debian:11","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-1+deb11u1"}]}],"versions":["2.7.4-1"],"bundled":3},{"source":"osv","ecosystem":"RubyGems","package":"cgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0"},{"fixed":"0.3.1"}]}],"versions":["0.3.0"]},{"source":"osv","ecosystem":"RubyGems","package":"cgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0"},{"fixed":"0.2.1"}]}],"versions":["0.2.0"]},{"source":"osv","ecosystem":"RubyGems","package":"cgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0.1"}]}],"versions":["0.1.0"]},{"source":"osv","ecosystem":"Mageia:8","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-33.2.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.4-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.0-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.33-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.7-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.5-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.1-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.14.2-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.0.3-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.9-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.7-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.2-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.33-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby30-rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.33-149.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.0-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.24-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-did_you_mean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.0-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.6-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.13.0-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-net-telnet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.0-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.3-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.7-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.0-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.16-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.0.1-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.1-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.4-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygem-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.6-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-ruby27-rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.6-131.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.6"}]}],"versions":["2.7.0-1","2.7.0-2","2.7.0-3","2.7.0-4","2.7.0-4ubuntu1","2.7.0-5ubuntu1","2.7.0-5ubuntu1.1","2.7.0-5ubuntu1.2","2.7.0-5ubuntu1.3","2.7.0-5ubuntu1.4","2.7.0-5ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-7ubuntu2"}]}],"versions":["3.0.2-5ubuntu1","3.0.2-7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~ubuntu16.04.16+esm2"}]}],"versions":["2.3.0-1","2.3.0-2","2.3.0-4ubuntu2","2.3.0-4ubuntu3","2.3.0-5ubuntu1","2.3.1-2~16.04","2.3.1-2~16.04.2","2.3.1-2~16.04.4","2.3.1-2~16.04.5","2.3.1-2~16.04.6","2.3.1-2~16.04.7","2.3.1-2~16.04.9","2.3.1-2~16.04.10","2.3.1-2~16.04.11","2.3.1-2~16.04.12","2.3.1-2~ubuntu16.04.13","2.3.1-2~ubuntu16.04.14","2.3.1-2~ubuntu16.04.15","2.3.1-2~ubuntu16.04.16","2.3.1-2~ubuntu16.04.16+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu1.11"}]}],"versions":["2.5.0~preview1-1ubuntu2","2.5.0-4ubuntu1","2.5.0-4ubuntu4","2.5.0-5ubuntu1","2.5.0-6ubuntu1","2.5.1-1ubuntu1","2.5.1-1ubuntu1.1","2.5.1-1ubuntu1.2","2.5.1-1ubuntu1.4","2.5.1-1ubuntu1.5","2.5.1-1ubuntu1.6","2.5.1-1ubuntu1.7","2.5.1-1ubuntu1.8","2.5.1-1ubuntu1.9","2.5.1-1ubuntu1.10"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-5ubuntu1.6"}]}],"versions":["2.7.0-1","2.7.0-2","2.7.0-3","2.7.0-4","2.7.0-4ubuntu1","2.7.0-5ubuntu1","2.7.0-5ubuntu1.1","2.7.0-5ubuntu1.2","2.7.0-5ubuntu1.3","2.7.0-5ubuntu1.4","2.7.0-5ubuntu1.5"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-1.2"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-1.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0~preview2-1.1"}]}],"bundled":12}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"ruby-lang","product":"cgi"}],"references":[{"url":"https://hackerone.com/reports/1328463","tags":["x_transferred","Permissions Required","Third Party Advisory","report","web"]},{"url":"https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/","tags":["x_transferred","Exploit","Vendor Advisory","evidence","report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-41816","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220303-0006/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202401-27","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41816","tags":["advisory"]},{"url":"https://groups.google.com/g/ruby-security-ann/c/4MQ568ZG47c","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2021-41816.yml","tags":["web"]},{"url":"https://github.com/ruby/cgi/commit/959ccf0b6a672bcc64aeaa60c6e1f9e728f1e87f","tags":["web"]},{"url":"https://github.com/ruby/cgi/commit/ad079c1cb5f58eba1ffac46da79995fcf94a3a6e","tags":["web"]},{"url":"https://github.com/ruby/cgi/commit/c6a37a671b556eb06140ea89cc465136b24207a6","tags":["web"]},{"url":"https://github.com/ruby/cgi/commit/c728632c1c09d46cfd4ecbff9caaa3651dd1002a","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-5cqm-crxm-6qpv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-41816","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-41816","tags":["advisory"]},{"url":"https://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20220303-0006","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN","tags":["web"]},{"url":"https://github.com/ruby/cgi","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0579.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29004","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4922-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VF3QUOV6OJPCL64ZDHTQRENRJQZPZO6S/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CMW3G6JZK6A7ZRJZ7VOMELHWOQBYPIOY/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5020-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL/","tags":["web"]},{"url":"http://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/","tags":["web"]},{"url":"http://www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/","tags":["web"]},{"url":"http://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6855","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026752","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128628","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128629","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6855.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41816","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41816","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41817","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41817","tags":["advisory"]},{"url":"https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41819","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41819","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28738","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28738","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28738","tags":["advisory"]},{"url":"http://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28739","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28739","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28739","tags":["advisory"]},{"url":"http://www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6856","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128631","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6856.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-41816","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5235-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-41817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41819","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28755","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4CUQQ6QHKQ66CAQFISBEQ34A2SLDQ5JS/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-41816","description":"CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.","status":"published","published":"2022-02-06T00:00:00Z","modified":"2024-08-04T03:22:24.883Z","updated_at":"2026-11-02T14:32:59.105382Z"}],"euvd":[{"id":"EUVD-2021-2447","description":"CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.","status":"published","published":"2022-02-06T00:00:00Z","modified":"2024-08-04T03:22:24Z","updated_at":"2026-11-03T03:24:17.230256Z"}],"ghsa":[{"id":"GHSA-5cqm-crxm-6qpv","title":"Buffer overrun in CGI.escape_html","description":"A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (\u003e 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.","status":"published","published":"2021-12-14T21:36:20Z","modified":"2024-01-24T19:18:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:37:32.302254Z"}],"nvd":[{"id":"CVE-2021-41816","description":"CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.","status":"published","published":"2022-02-06T21:15:07.887Z","modified":"2026-06-17T04:08:57.32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:07:04.178977Z"}],"osv":[{"id":"ALPINE-CVE-2021-41816","description":"CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.","status":"published","published":"2022-02-06T21:15:07.887Z","modified":"2026-10-23T17:17:56.215797227Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"BELL-CVE-2021-41816","title":"CVE-2021-41816 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:53.904181Z","modified":"2026-01-26T10:04:53.401637Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-41816","description":"CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.","status":"published","published":"2022-02-06T21:15:07.887Z","modified":"2026-10-24T10:30:25.605911957Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"DEBIAN-CVE-2021-41816","description":"CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.","status":"published","published":"2022-02-06T21:15:07.887Z","modified":"2026-08-27T23:04:10.602001553Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"GHSA-5cqm-crxm-6qpv","title":"Buffer overrun in CGI.escape_html","description":"A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (\u003e 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.","status":"published","published":"2021-12-14T21:36:20Z","modified":"2026-08-13T20:11:58.269981947Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"RHSA-2022:6855","title":"Red Hat Security Advisory: rh-ruby30-ruby security, bug fix, and enhancement update","status":"published","published":"2024-10-01T14:47:52Z","modified":"2026-06-29T10:43:21Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:6856","title":"Red Hat Security Advisory: rh-ruby27-ruby security, bug fix, and enhancement update","status":"published","published":"2024-10-01T14:48:02Z","modified":"2026-06-29T10:43:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"UBUNTU-CVE-2021-41816","description":"CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.","status":"published","published":"2021-12-02T00:00:00Z","modified":"2026-04-22T13:01:00.868243Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"DSA-5067-1","title":"ruby2.7 - security update","status":"published","published":"2022-02-03T00:00:00Z","modified":"2026-03-09T02:09:18.471705Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2021-0579","title":"Updated ruby packages fix security vulnerability","description":"Bundler sometimes chooses a dependency source based on the highest gem\nversion number, which means that a rogue gem found at a public source\nmay be chosen, even if the intended choice was a private gem that is a\ndependency of another private gem that is explicitly depended on by the\napplication. (CVE-2020-36327)\n\nThe REXML gem does not properly address XML round-trip issues. An\nincorrect document can be produced after parsing and serializing.\n(CVE-2021-28965)\n\nIn RDoc it is possible to execute arbitrary code via | and tags in a\nfilename. (CVE-2021-31799)\n\nA malicious FTP server can use the PASV response to trick Net::FTP into\nconnecting back to a given IP address and port. This potentially makes\ncurl extract information about services that are otherwise private and not\ndisclosed (e.g., the attacker can conduct port scans and service banner\nextractions).  (CVE-2021-31810)\n\nRuby Net::IMAP does not raise an exception when StartTLS fails with an an\nunknown response, which might allow man-in-the-middle attackers to bypass\nthe TLS protections by leveraging a network position between the client\nand the registry to block the StartTLS command, aka a \"StartTLS stripping\nattack.\" (CVE-2021-32066)\n\nBuffer Overrun in CGI.escape_html (CVE-2021-41816)\n\nRegular Expression Denial of Service Vulnerability of Date Parsing Methods\n(CVE-2021-41817)\n\nCookie Prefix Spoofing in CGI::Cookie.parse (CVE-2021-41819)\n","status":"published","published":"2021-12-23T21:01:45Z","modified":"2026-04-16T04:44:19.204269684Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:11657-1","title":"libruby2_7-2_7-2.7.5-1.1 on GA media","description":"These are all security issues fixed in the libruby2_7-2_7-2.7.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:51:09.455315Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11658-1","title":"libruby3_0-3_0-3.0.3-1.1 on GA media","description":"These are all security issues fixed in the libruby3_0-3_0-3.0.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:48:43.013616Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11786-1","title":"libruby3_1-3_1-3.1.0-1.1 on GA media","description":"These are all security issues fixed in the libruby3_1-3_1-3.1.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:23:48.669467Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:12712-1","title":"libruby3_2-3_2-3.2.1-1.1 on GA media","description":"These are all security issues fixed in the libruby3_2-3_2-3.2.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:56:59.828847Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:13623-1","title":"libruby3_3-3_3-3.3.0-1.2 on GA media","description":"These are all security issues fixed in the libruby3_3-3_3-3.3.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:22:16.198815Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2025:14621-1","title":"libruby3_4-3_4-3.4.1-1.1 on GA media","description":"These are all security issues fixed in the libruby3_4-3_4-3.4.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-07T00:00:00Z","modified":"2026-02-04T04:21:36.904924Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:15819-1","title":"libruby4_0-4_0-4.0.0~preview2-1.1 on GA media","description":"These are all security issues fixed in the libruby4_0-4_0-4.0.0~preview2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-12-12T00:00:00Z","modified":"2026-02-04T02:51:30.161379Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"USN-5235-1","title":"ruby2.3, ruby2.5, ruby2.7 vulnerabilities","description":"It was discovered that Ruby incorrectly handled certain HTML files.\nAn attacker could possibly use this issue to cause a crash. This\nissue only affected Ubuntu 20.04 LTS, Ubuntu 21.04, and Ubuntu 21.10.\n(CVE-2021-41816)\n\nIt was discovered that Ruby incorrectly handled certain regular expressions.\nAn attacker could possibly use this issue to cause a regular expression\ndenial of service. (CVE-2021-41817)\n\nIt was discovered that Ruby incorrectly handled certain cookie names.\nAn attacker could possibly use this issue to access or expose\nsensitive information. (CVE-2021-41819)\n","status":"published","published":"2022-01-18T17:13:18Z","modified":"2026-06-25T13:30:56.535282724Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}