CVE-2025-27221
published 2025-03-04CVE-2025-27221: In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.47%
38.2th percentile
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ruby2.7 | < ruby2.7 2.7.4-1+deb11u5 (bullseye) | ruby2.7 2.7.4-1+deb11u5 (bullseye) |
| debian | ruby2.7 | — | — |
| debian | ruby3.1 | < ruby2.7 2.7.4-1+deb11u5 (bullseye) | ruby2.7 2.7.4-1+deb11u5 (bullseye) |
| debian | ruby3.1 | — | — |
| debian | ruby3.3 | < ruby2.7 2.7.4-1+deb11u5 (bullseye) | ruby2.7 2.7.4-1+deb11u5 (bullseye) |
| debian | ruby3.3 | — | — |
| debian | rubygems | < ruby2.7 2.7.4-1+deb11u5 (bullseye) | ruby2.7 2.7.4-1+deb11u5 (bullseye) |
| debian | rubygems | — | — |
| msrc | azl3_ruby_3.3.5-3_on_azure_linux_3.0 | — | — |
| msrc | azl3_ruby_3.3.5-6_on_azure_linux_3.0 | — | — |
| msrc | azl3_ruby_3.3.5-7_on_azure_linux_3.0 | — | — |
| msrc | cbl2_ruby_3.1.4-9_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_ruby_3.1.7-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_ruby_3.1.7-4_on_cbl_mariner_2.0 | — | — |
| ruby-lang | uri | < 0.11.3 | 0.11.3 |
| ruby-lang | uri | < 0.12.5 | 0.12.5 |
| ruby-lang | uri | >= 0 < 0.11.3 | 0.11.3 |
| ruby-lang | uri | >= 0 < 0.12.5 | 0.12.5 |
| ruby-lang | uri | >= 0.12.0 < 0.12.4 | 0.12.4 |
| ruby-lang | uri | >= 0.12.0 < 0.12.4 | 0.12.4 |
| ruby-lang | uri | >= 0.13.0 < 0.13.2 | 0.13.2 |
| ruby-lang | uri | >= 0.13.0 < 0.13.3 | 0.13.3 |
| ruby-lang | uri | >= 0.13.0 < 0.13.2 | 0.13.2 |
| ruby-lang | uri | >= 0.13.0 < 0.13.3 | 0.13.3 |
| ruby-lang | uri | >= 1.0.0 < 1.0.3 | 1.0.3 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
ghsa5.3MEDIUM
osv6.6MEDIUM
vendor_ubuntu7.5HIGH
vendor_debian3.2LOW
vendor_msrc3.2LOW
vendor_redhat3.2LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-61594: URI is a module providing classes to handle Uniform Resource Identifiers
osv·2025-12-30·CVSS 5.3
CVE-2025-61594 [MEDIUM] CVE-2025-61594: URI is a module providing classes to handle Uniform Resource Identifiers
URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.
OSV
URI Credential Leakage Bypass over CVE-2025-27221
osv·2025-12-30·CVSS 5.3
CVE-2025-61594 [MEDIUM] URI Credential Leakage Bypass over CVE-2025-27221
URI Credential Leakage Bypass over CVE-2025-27221
### Impact
In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.
When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.
The vulnerability affects the `uri` gem bundled with the following Ruby series:
* 0.12.4 and earlier (bundled in Ruby 3.2 series)
* 0.13.2 and earlier (bundled in Ruby 3.3 series)
* 1.0.3 and earlier (bundled in Ruby 3.4 series)
### Patches
Upgrade to 0.12.5, 0.13.3 or 1.0.4
### References
* https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/
* https://hackerone.com/reports/2957667
GHSA
URI Credential Leakage Bypass over CVE-2025-27221
ghsa·2025-12-30·CVSS 5.3
CVE-2025-61594 [MEDIUM] CWE-212 URI Credential Leakage Bypass over CVE-2025-27221
URI Credential Leakage Bypass over CVE-2025-27221
### Impact
In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.
When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.
The vulnerability affects the `uri` gem bundled with the following Ruby series:
* 0.12.4 and earlier (bundled in Ruby 3.2 series)
* 0.13.2 and earlier (bundled in Ruby 3.3 series)
* 1.0.3 and earlier (bundled in Ruby 3.4 series)
### Patches
Upgrade to 0.12.5, 0.13.3 or 1.0.4
### References
* https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/
* https://hackerone.com/reports/2957667
OSV
ruby2.3, ruby2.5 vulnerabilities
osv·2025-04-17·CVSS 6.6
CVE-2025-27219 [MEDIUM] ruby2.3, ruby2.5 vulnerabilities
ruby2.3, ruby2.5 vulnerabilities
It was discovered that the Ruby CGI gem incorrectly handled parsing certain
cookies. A remote attacker could possibly use this issue to consume
resources, leading to a denial of service. (CVE-2025-27219)
It was discovered that the Ruby CGI gem incorrectly handled parsing certain
regular expressions. A remote attacker could possibly use this issue to
consume resources, leading to a denial of service. (CVE-2025-27220)
It was discovered that the Ruby URI gem incorrectly handled certain URI
handling methods. A remote attacker could possibly use this issue to leak
authentication credentials. (CVE-2025-27221)
It was discovered that the Ruby REXML gem incorrectly handled parsing XML
documents containing many digits in a hex numeric character reference. A
remot
OSV
ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerabilities
osv·2025-04-07·CVSS 5.3
CVE-2024-35176 [MEDIUM] ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerabilities
ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerabilities
It was discovered that Ruby incorrectly handled parsing of an XML document
that has specific XML characters in an attribute value using REXML gem. An
attacker could use this issue to cause Ruby to crash, resulting in a
denial of service. This issue only affected in Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, and Ubuntu 24.10. (CVE-2024-35176, CVE-2024-39908,
CVE-2024-41123, CVE-2024-43398)
It was discovered that Ruby incorrectly handled expanding ranges in the
net-imap response parser. If a user or automated system were tricked into
connecting to a malicious IMAP server, a remote attacker could possibly use
this issue to consume memory, leading to a denial of service. This issue
only affected Ubuntu 24.04 LTS, and Ubuntu 24.10. (CVE-2025-25186)
OSV
CVE-2025-27221: In the URI gem before 1
osv·2025-03-04·CVSS 5.3
CVE-2025-27221 [MEDIUM] CVE-2025-27221: In the URI gem before 1
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
OSV
URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+
osv·2025-03-03·CVSS 5.3
CVE-2025-27221 [MEDIUM] URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+
URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+
There is a possibility for userinfo leakage by in the uri gem.
This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem.
## Details
The methods `URI#join`, `URI#merge`, and `URI#+` retained userinfo, such as `user:password`, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur.
Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later.
## Affected versions
uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2.
## Credits
Thanks to Tsubasa Irisawa (lambdasawa) for discovering
GHSA
URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+
ghsa·2025-03-03·CVSS 5.3
CVE-2025-27221 [MEDIUM] CWE-200 URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+
URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+
There is a possibility for userinfo leakage by in the uri gem.
This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem.
## Details
The methods `URI#join`, `URI#merge`, and `URI#+` retained userinfo, such as `user:password`, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur.
Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later.
## Affected versions
uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2.
## Credits
Thanks to Tsubasa Irisawa (lambdasawa) for discovering
Red Hat
uri: URI module: Credential exposure via URI + operator
vendor_redhat·2025-12-30·CVSS 3.2
CVE-2025-61594 [LOW] CWE-212 uri: URI module: Credential exposure via URI + operator
uri: URI module: Credential exposure via URI + operator
URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.
A flaw was found in the URI module. A remote attacker could exploit this vulnerability by using the `+` operator to combine Uniform Resource Identifiers (URIs). This bypasses a previous fix and can lead to the leakage of sensitive information, such as user credentials (passwords), from the ori
Microsoft
URI Credential Leakage Bypass over CVE-2025-27221
vendor_msrc·2025-12-09·CVSS 3.2
CVE-2025-61594 [LOW] CWE-212 URI Credential Leakage Bypass over CVE-2025-27221
URI Credential Leakage Bypass over CVE-2025-27221
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Ubuntu
Ruby vulnerabilities
vendor_ubuntu·2025-04-17·CVSS 7.5
CVE-2025-27220 [HIGH] Ruby vulnerabilities
Title: Ruby vulnerabilities
Summary: Several security issues were fixed in Ruby.
It was discovered that the Ruby CGI gem incorrectly handled parsing certain
cookies. A remote attacker could possibly use this issue to consume
resources, leading to a denial of service. (CVE-2025-27219)
It was discovered that the Ruby CGI gem incorrectly handled parsing certain
regular expressions. A remote attacker could possibly use this issue to
consume resources, leading to a denial of service. (CVE-2025-27220)
It was discovered that the Ruby URI gem incorrectly handled certain URI
handling methods. A remote attacker could possibly use this issue to leak
authentication credentials. (CVE-2025-27221)
It was discovered that the Ruby REXML gem incorrectly handled parsing XML
documents containing many dig
Ubuntu
Ruby vulnerabilities
vendor_ubuntu·2025-04-07·CVSS 5.3
CVE-2024-35176 [MEDIUM] Ruby vulnerabilities
Title: Ruby vulnerabilities
Summary: Several security issues were fixed in Ruby.
It was discovered that Ruby incorrectly handled parsing of an XML document
that has specific XML characters in an attribute value using REXML gem. An
attacker could use this issue to cause Ruby to crash, resulting in a
denial of service. This issue only affected in Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, and Ubuntu 24.10. (CVE-2024-35176, CVE-2024-39908,
CVE-2024-41123, CVE-2024-43398)
It was discovered that Ruby incorrectly handled expanding ranges in the
net-imap response parser. If a user or automated system were tricked into
connecting to a malicious IMAP server, a remote attacker could possibly use
this issue to consume memory, leading to a denial of service. This issue
only affected Ubuntu 24.04 LTS, and
Microsoft
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing t
vendor_msrc·2025-03-11·CVSS 3.2
CVE-2025-27221 [LOW] CWE-212 In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing t
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will up
Red Hat
uri: userinfo leakage in URI#join, URI#merge and URI#+
vendor_redhat·2025-03-03·CVSS 3.2
CVE-2025-27221 [LOW] CWE-212 uri: userinfo leakage in URI#join, URI#merge and URI#+
uri: userinfo leakage in URI#join, URI#merge and URI#+
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
A flaw was found in the URI ruby gem package, where userinfo leakage can occur in the uri gem. The methods URI#join, URI#merge, and URI#+ retained userinfo, such as user:password, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak can occur.
Package: ruby-30 (Red Hat Enterprise Linux 9) - Fix deferred
Package: ruby-31 (Red Hat Enterprise Linux 9) - Fix deferred
Package: ruby-33 (Re
Debian
CVE-2025-27221: ruby2.7 - In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#me...
vendor_debian·2025·CVSS 3.2
CVE-2025-27221 [LOW] CVE-2025-27221: ruby2.7 - In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#me...
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
Scope: local
bullseye: resolved (fixed in 2.7.4-1+deb11u5)
Debian
CVE-2025-61594: ruby2.7 - URI is a module providing classes to handle Uniform Resource Identifiers. In ver...
vendor_debian·2025·CVSS 3.2
CVE-2025-61594 [LOW] CVE-2025-61594: ruby2.7 - URI is a module providing classes to handle Uniform Resource Identifiers. In ver...
URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.
Scope: local
bullseye: open
No detection rules found.
No public exploits indexed.
2025-03-04
Published