CVE-2021-41819: Debian Linux

High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days.

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 34 only; version 35 only
• Opensuse Factory: affected versions not specified
• Opensuse Leap: version 15.2 only
• Red Hat Enterprise Linux: version 8.0 only
• Red Hat Software Collections: affected versions not specified
• Ruby-Lang Cgi: version 0.1.0 only; version 0.2.0 only; version 0.3.0 only
• Ruby-Lang Ruby: up to and including 2.6.8; from 2.7.0, before 2.7.5 (fixed in 2.7.5); from 3.0.0, before 3.0.3 (fixed in 3.0.3)
• Suse Linux Enterprise: version 11.0 only; version 12.0 only; version 15.0 only

Published 2022-01-01. Last modified 2026-06-17.