URI Credential Leakage Bypass over CVE-2025-27221
Priority LOW 18CWE-200Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0056 46th percentileScored 2026-11-07
Fix Partial uri (ruby): 0.12.5, 0.13.3, 1.0.4uri (RubyGems): 0.12.5, 0.13.3, 1.0.4Red Hat: 3 advisoriesRed Hat: 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ruby | uri | before 0.12.5; 0.13.0 to before 0.13.3; 1.0.0 to before 1.0.4 | 0.12.5, 0.13.3, 1.0.4 | Patch available | CNA |
| — | uri (RubyGems) | before 0.12.5 | 0.12.5 | Patch available | GHSA-j4pr-3wm6-xx2r |
| — | uri (RubyGems) | 0.13.0 to before 0.13.3 | 0.13.3 | Patch available | GHSA-j4pr-3wm6-xx2r |
| — | uri (RubyGems) | 1.0.0 to before 1.0.4 | 1.0.4 | Patch available | GHSA-j4pr-3wm6-xx2r |
- uri Vendorruby Affected before 0.12.5; 0.13.0 to before 0.13.3; 1.0.0 to before 1.0.4 Fixed in 0.12.5, 0.13.3, 1.0.4 Patch available CNA
- uri (RubyGems) Vendor— Affected before 0.12.5 Fixed in 0.12.5 Patch available GHSA-j4pr-3wm6-xx2r
- uri (RubyGems) Vendor— Affected 0.13.0 to before 0.13.3 Fixed in 0.13.3 Patch available GHSA-j4pr-3wm6-xx2r
- uri (RubyGems) Vendor— Affected 1.0.0 to before 1.0.4 Fixed in 1.0.4 Patch available GHSA-j4pr-3wm6-xx2r
Remediation
- Fix · CNA uri (ruby) Fixed in 0.12.5, 0.13.3, 1.0.4
- Fix · GHSA-j4pr-3wm6-xx2r uri (RubyGems) Fixed in 0.12.5 Advisory →
- Fix · GHSA-j4pr-3wm6-xx2r uri (RubyGems) Fixed in 0.13.3 Advisory →
- Fix · GHSA-j4pr-3wm6-xx2r uri (RubyGems) Fixed in 1.0.4 Advisory →
Red Hat 3 advisories
- RHSA-2025:23141 Released 2025-12-11 · Red Hat rating Moderateruby security update
- Red Hat Enterprise Linux AppStream (v. 10) ruby-3.3.10-11.el10_1, ruby-bundled-gems-3.3.10-11.el10_1, ruby-default-gems-3.3.10-11.el10_1 +20
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby-doc-3.3.10-11.el10_1
- RHSA-2025:23062 Released 2025-12-10 · Red Hat rating Moderateruby:3.3 security update
- Red Hat Enterprise Linux AppStream (v. 8) ruby-3.3.10-5.module+el8.10.0+23696+c42b0f57.aarch64::ruby:3.3, ruby-3.3.10-5.module+el8.10.0+23696+c42b0f57.i686::ruby:3.3, ruby-3.3.10-5.module+el8.10.0+23696+c42b0f57.ppc64le::ruby:3.3 +47
- RHSA-2025:23063 Released 2025-12-10 · Red Hat rating Moderateruby:3.3 security update
- Red Hat Enterprise Linux AppStream (v. 9) ruby-3.3.10-5.module+el9.7.0+23651+15dc1615.aarch64::ruby:3.3, ruby-3.3.10-5.module+el9.7.0+23651+15dc1615.i686::ruby:3.3, ruby-3.3.10-5.module+el9.7.0+23651+15dc1615.ppc64le::ruby:3.3 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-61594
- 2026-10-03 Alias added: GHSA-j4pr-3wm6-xx2r
References
Advisory 2
Other 9
- https://github.com/ruby/uri/security/advisories/GHSA-j4pr-3wm6-xx2r
- https://hackerone.com/reports/2957667
- https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
- https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902
- https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c
- https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a
- https://github.com/ruby/uri
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml
- https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594
More ruby Uri vulnerabilities
- TI-2023-13266 A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. CVSS 3.1MEDIUM 5.3
- TI-2023-18437 A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. CVSS 3.1MEDIUM 5.3
- TI-2025-20078 Information disclosure in ruby URI CVSS 3.1MEDIUM 5.3
Sources
- CVE-2025-61594 · CVE Program
- CVE-2025-61594 · NVD
- FIRST EPSS
- GHSA-j4pr-3wm6-xx2r · GitHub Advisory Database · CC BY 4.0
- CVE-2025-61594 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences