CVE-2025-27221 — Improper Removal of Sensitive Information Before Storage or Transfer in URI

CWE-212 — Improper Removal of Sensitive Information Before Storage or TransferCWE-200 — Sensitive Information Exposure18 documents7 sources
Severity
5.3MEDIUMNVD
NVD2.7OSV6.6
EPSS
0.1%
top 66.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
Ruby URIRubygemsRuby-lang URI+10 more
Timeline
PublishedMar 4
Latest updateDec 30

Description

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages14 packages

▶CVEListV5ruby/uri< 0.12.5+2
▶NVDruby-lang/uri0.12.0 — 0.12.4+6
▶RubyGemsruby-lang/uri0.12.0 — 0.12.4+6
▶debiandebian/ruby2.7< ruby2.7 2.7.4-1+deb11u5 (bullseye)+1
▶debiandebian/ruby3.1< ruby2.7 2.7.4-1+deb11u5 (bullseye)+1

🔴Vulnerability Details

8
OSV
CVE-2025-61594: URI is a module providing classes to handle Uniform Resource Identifiers↗2025-12-30
▶
OSV
URI Credential Leakage Bypass over CVE-2025-27221↗2025-12-30
▶
GHSA
URI Credential Leakage Bypass over CVE-2025-27221↗2025-12-30
▶
OSV
ruby2.3, ruby2.5 vulnerabilities↗2025-04-17
▶
OSV
ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerabilities↗2025-04-07
▶

📋Vendor Advisories

8
Red Hat
uri: URI module: Credential exposure via URI + operator↗2025-12-30
▶
Microsoft
URI Credential Leakage Bypass over CVE-2025-27221↗2025-12-09
▶
Ubuntu
Ruby vulnerabilities↗2025-04-17
▶
Ubuntu
Ruby vulnerabilities↗2025-04-07
▶
Microsoft
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing t↗2025-03-11
▶