URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00015.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Ruby-lang
  • Uri

Configuration 1 [-]

OR cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*
cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*
cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Ruby-lang
  • Uri
References
Link Providers
https://github.com/advisories/GHSA-22h5-pq3x-2gf2 cve-icon cve-icon
https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902 cve-icon
https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c cve-icon
https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a cve-icon
https://github.com/ruby/uri/security/advisories/GHSA-j4pr-3wm6-xx2r cve-icon cve-icon
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml cve-icon
https://hackerone.com/reports/2957667 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-61594 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-61594 cve-icon
https://www.ruby-lang.org/en/news/2025/02/26/security-advisories cve-icon cve-icon
https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594/ cve-icon
History

Thu, 16 Apr 2026 17:30:00 +0000

Type Values Removed Values Added
Description URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue. URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.
Weaknesses CWE-200
References
Metrics cvssV4_0

{'score': 2.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U'}

 cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N'}

Tue, 24 Feb 2026 15:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Mon, 05 Jan 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Ruby-lang
Ruby-lang uri
Vendors & Products Ruby-lang
Ruby-lang uri

Fri, 02 Jan 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

threat_severity

Moderate

Tue, 30 Dec 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 30 Dec 2025 21:15:00 +0000

Type Values Removed Values Added
Description URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.
Title URI Credential Leakage Bypass over CVE-2025-27221
Weaknesses CWE-212
References
Metrics cvssV4_0

{'score': 2.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-16T17:02:32.149Z

Reserved: 2025-09-26T16:25:25.150Z

Link: CVE-2025-61594

cve-icon Vulnrichment

Updated: 2025-12-30T21:29:36.147Z

cve-icon NVD

Status : Modified

Published: 2025-12-30T21:15:43.893

Modified: 2026-04-16T18:16:44.400

Link: CVE-2025-61594

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-12-30T21:03:08Z

Links: CVE-2025-61594 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-01-05T10:19:26Z