CVE-2025-27220 (MEDIUM): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2025-27220	MEDIUM	cgi	0.4.1	~> 0.3.5.1, ~> 0.3.7, >= 0.4.2	2025-03-04T00:15:31.693Z	2025-03-04T10:20:33.274086718Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/ruby:latest	public.ecr.aws/lambda/ruby@sha256:50721a5c1f2ae6d6755c6ff71a313e89ea27301eeb2f0e5fa7cbe86bc4a755e0
public.ecr.aws/lambda/ruby:3.3	public.ecr.aws/lambda/ruby@sha256:50721a5c1f2ae6d6755c6ff71a313e89ea27301eeb2f0e5fa7cbe86bc4a755e0

---

Description

In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.

---

Remediation Steps

• Update the affected package cgi from version 0.4.1 to ~> 0.3.5.1, ~> 0.3.7, >= 0.4.2.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.