{"action":"Upgrade cgi to 0.1.0.2 or later.","affected":[{"fixed":"0.3.5","introduced":"0.3.0"},{"fixed":"0.2.2","introduced":"0.2.0"},{"fixed":"0.1.0.2","introduced":"0"}],"component":"cgi","cve_ids":["CVE-2021-33621"],"ecosystem":"RubyGems","epss":0.0244,"exploited":false,"fixed_versions":["0.3.5","0.2.2","0.1.0.2"],"ghsa_id":"GHSA-vc47-6rqg-c7f5","id":"tcs_01M5KENGM6AT5CYSREW1ZX76YA","modified_at":"2026-08-13T20:11:58.150676170Z","published_at":"2022-11-19T00:30:55Z","references":["https://osv.dev/vulnerability/GHSA-vc47-6rqg-c7f5","https://nvd.nist.gov/vuln/detail/CVE-2021-33621","https://hackerone.com/reports/1204695","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2021-33621.yml","https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html","https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YACE6ORF2QBXXBK2V2CM36D7TZMEJVAS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DQR7LWED6VAPD5ATYOBZIGJQPCUBRJBX","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YACE6ORF2QBXXBK2V2CM36D7TZMEJVAS","https://security.gentoo.org/glsa/202401-27","https://security.netapp.com/advisory/ntap-20221228-0004","https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-vc47-6rqg-c7f5","url":"https://osv.dev/vulnerability/GHSA-vc47-6rqg-c7f5"}],"summary":"HTTP response splitting in CGI"}