PT-2026-80528

Published

2026-08-13

·

Updated

2026-08-13

Description by

CVSS 3.1
8.8
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.
Exploitability
Fix
Vendors
Affected products
Related identifiers
JLSEC-2026-1286
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com