{"schema_version":"1.7.5","id":"CVE-2021-41819","published":"2022-01-01T06:15:07.293Z","modified":"2026-07-09T01:25:29.088490Z","aliases":["BIT-ruby-2021-41819","BIT-ruby-min-2021-41819","GHSA-4vf4-qmvg-mh7h"],"related":["ALSA-2022:0543","ALSA-2022:5779","ALSA-2022:6447","ALSA-2022:6450","SUSE-SU-2022:3292-1","openSUSE-SU-2024:11657-1","openSUSE-SU-2024:11658-1","openSUSE-SU-2024:11786-1","openSUSE-SU-2024:12712-1","openSUSE-SU-2024:13623-1","openSUSE-SU-2025:14621-1","openSUSE-SU-2025:15819-1"],"details":"CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ruby/cgi","events":[{"introduced":"cf0564fe0e01f816c0602456333c82cc8bde8cf7"},{"last_affected":"95324433b41daf7f292ba84f15b355abb7105c40"}],"database_specific":{"cpe":["cpe:2.3:a:ruby-lang:cgi:0.1.0:*:*:*:*:ruby:*:*","cpe:2.3:a:ruby-lang:cgi:0.2.0:*:*:*:*:ruby:*:*","cpe:2.3:a:ruby-lang:cgi:0.3.0:*:*:*:*:ruby:*:*"],"extracted_events":[{"introduced":"0.1.0"},{"last_affected":"0.1.0"},{"introduced":"0.2.0"},{"last_affected":"0.2.0"},{"introduced":"0.3.0"},{"last_affected":"0.3.0"}],"source":"CPE_STRING"}}],"versions":["0.1.0","0.2.0","0.3.0","v0.2.0","v0.1.0","v0.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41819.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ruby/ruby","events":[{"introduced":"0"},{"last_affected":"768423edc2634574d66f14f3c2d3602326bfb464"},{"introduced":"647ee6f091eafcce70ffb75ddf7e121e192ab217"},{"fixed":"f69aeb83146be640995753667fdd6c6f157527f5"},{"introduced":"95aff214687a5e12c3eb57d056665741e734c188"},{"fixed":"3fb7d2cadc18472ec107b14234933b017a33c14d"}],"database_specific":{"cpe":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"2.6.8"},{"introduced":"2.7.0"},{"fixed":"2.7.5"},{"introduced":"3.0.0"},{"fixed":"3.0.3"}],"source":"CPE_RANGE"}}],"versions":["v2_7_4","v3_0_2","v2_6_8","v3_0_1","v2_7_3","v3_0_0","v2_7_2","v2_7_1","v2_7_0","v1_0_r2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41819.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["221608888545214764521643589590002473795","62837079863855754692353823286478885059","151633818343694841750591657495653307518","112628295566100827065348454738811594068"],"threshold":0.9},"id":"CVE-2021-41819-11445fd0","signature_type":"Line","signature_version":"v1","source":"https://github.com/ruby/ruby/commit/3fb7d2cadc18472ec107b14234933b017a33c14d","target":{"file":"ext/cgi/escape/escape.c"}},{"deprecated":false,"digest":{"function_hash":"185553476159107413192269642060714357735","length":658},"id":"CVE-2021-41819-2f76299c","signature_type":"Function","signature_version":"v1","source":"https://github.com/ruby/ruby/commit/f69aeb83146be640995753667fdd6c6f157527f5","target":{"file":"ext/cgi/escape/escape.c","function":"optimized_escape_html"}},{"deprecated":false,"digest":{"line_hashes":["221608888545214764521643589590002473795","62837079863855754692353823286478885059","151633818343694841750591657495653307518","112628295566100827065348454738811594068"],"threshold":0.9},"id":"CVE-2021-41819-799f160e","signature_type":"Line","signature_version":"v1","source":"https://github.com/ruby/ruby/commit/f69aeb83146be640995753667fdd6c6f157527f5","target":{"file":"ext/cgi/escape/escape.c"}},{"deprecated":false,"digest":{"function_hash":"185553476159107413192269642060714357735","length":658},"id":"CVE-2021-41819-dfee3243","signature_type":"Function","signature_version":"v1","source":"https://github.com/ruby/ruby/commit/3fb7d2cadc18472ec107b14234933b017a33c14d","target":{"file":"ext/cgi/escape/escape.c","function":"optimized_escape_html"}}],"vanir_signatures_modified":"2026-07-09T01:25:29Z"}}],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202401-27"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20220121-0003/"},{"type":"REPORT","url":"https://hackerone.com/reports/910552"},{"type":"EVIDENCE","url":"https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"},{"introduced":"10.0"},{"last_affected":"10.0"},{"introduced":"11.0"},{"last_affected":"11.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"},{"cpes":["cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"34"},{"last_affected":"34"},{"introduced":"35"},{"last_affected":"35"}],"source":"CPE_STRING","vendor_product":"fedoraproject:fedora"},{"cpes":["cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"15.2"},{"last_affected":"15.2"}],"source":"CPE_STRING","vendor_product":"opensuse:leap"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux"},{"cpes":["cpe:2.3:o:suse:linux_enterprise:11.0:sp1:*:*:*:*:*:*","cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*","cpe:2.3:o:suse:linux_enterprise:15.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"11.0-sp1"},{"last_affected":"11.0-sp1"},{"introduced":"12.0"},{"last_affected":"12.0"},{"introduced":"15.0"},{"last_affected":"15.0"}],"source":"CPE_STRING","vendor_product":"suse:linux_enterprise"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}