{"id":"JLSEC-2026-1288","details":"CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.","modified":"2026-08-13T10:00:06.407714193Z","published":"2026-08-13T09:49:53.975Z","upstream":["CVE-2021-41819"],"database_specific":{"sources":[{"modified":"2026-06-17T04:08:57.577Z","published":"2022-01-01T06:15:07.293Z","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-41819","html_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41819","database_specific":{"status":"Modified"},"id":"CVE-2021-41819","imported":"2026-08-12T15:35:15.514Z"}],"license":"CC-BY-4.0"},"references":[{"type":"WEB","url":"https://hackerone.com/reports/910552"},{"type":"WEB","url":"https://hackerone.com/reports/910552"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF/"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202401-27"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202401-27"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20220121-0003/"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20220121-0003/"},{"type":"WEB","url":"https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/"},{"type":"WEB","url":"https://www.ruby-lang.org/en/news/2021/11/24/cookie-prefix-spoofing-in-cgi-cookie-parse-cve-2021-41819/"}],"affected":[{"package":{"name":"ruby_jll","ecosystem":"Julia","purl":"pkg:julia/ruby_jll?uuid=3ea333e9-fd8a-53ca-adba-366e8551b7d5"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1288.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V2","score":"AV:N/AC:L/Au:N/C:N/I:P/A:N","source":"NVD"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"NVD"}]}