URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.
References
Configurations
Configuration 1 (hide)
|
History
24 Feb 2026, 14:57
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Ruby-lang uri
Ruby-lang |
|
| CPE | cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | () https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902 - Patch | |
| References | () https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c - Patch | |
| References | () https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a - Patch | |
| References | () https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml - Vendor Advisory | |
| References | () https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594/ - Vendor Advisory |
30 Dec 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-30 21:15
Updated : 2026-02-24 14:57
NVD link : CVE-2025-61594
Mitre link : CVE-2025-61594
CVE.ORG link : CVE-2025-61594
JSON object : View
Products Affected
ruby-lang
- uri
CWE
CWE-212
Improper Removal of Sensitive Information Before Storage or Transfer