GitHub Advisoryadvisory · RubyGems

GHSA-j4pr-3wm6-xx2r URI Credential Leakage Bypass over CVE-2025-27221

LOW Published 2025-12-30 Modified 2026-05-29 Official page ↗
Aliases
CVE-2025-61594
Ecosystem
RubyGems
Packages
uri
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-212
Reviewed
2025-12-30

Affected packages

• RubyGems uri: < 0.12.5 → fixed in 0.12.5 • RubyGems uri: >= 0.13.0, < 0.13.3 → fixed in 0.13.3 • RubyGems uri: >= 1.0.0, < 1.0.4 → fixed in 1.0.4

Description

Impact In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. The vulnerability affects the `uri` gem bundled with the following Ruby series: • 0.12.4 and earlier (bundled in Ruby 3.2 series) • 0.13.2 and earlier (bundled in Ruby 3.3 series) • 1.0.3 and earlier (bundled in Ruby 3.4 series) Patches Upgrade to 0.12.5, 0.13.3 or 1.0.4 References • https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/ • https://hackerone.com/reports/2957667

Related

Alias · CVE (1)

  • CVE-2025-61594 URI is a module providing classes to handle Uniform Resource Identifiers. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer weakness

References