CVE-2021-41816: Integer Overflow or Wraparound

February 6, 2022 (updated January 24, 2024)

CGI.escape_html in Ruby has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes.

References

github.com/advisories/GHSA-5cqm-crxm-6qpv
groups.google.com/g/ruby-security-ann/c/4MQ568ZG47c
hackerone.com/reports/1328463
nvd.nist.gov/vuln/detail/CVE-2021-41816
security-tracker.debian.org/tracker/CVE-2021-41816
www.ruby-lang.org/en/news/2021/11/24/buffer-overrun-in-cgi-escape_html-cve-2021-41816/

Code Behaviors & Features

Detect and mitigate CVE-2021-41816 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →