CVE-2025-61594
published 2025-12-30CVE-2025-61594: URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.51%
40.5th percentile
URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ruby2.7 | — | — |
| debian | ruby3.1 | — | — |
| debian | ruby3.3 | — | — |
| debian | rubygems | — | — |
| msrc | azl3_ruby_3.3.5-6_on_azure_linux_3.0 | — | — |
| msrc | azl3_ruby_3.3.5-7_on_azure_linux_3.0 | — | — |
| msrc | cbl2_ruby_3.1.7-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_ruby_3.1.7-4_on_cbl_mariner_2.0 | — | — |
| ruby-lang | uri | < 0.12.5 | 0.12.5 |
| ruby-lang | uri | >= 0 < 0.12.5 | 0.12.5 |
| ruby-lang | uri | >= 0.13.0 < 0.13.3 | 0.13.3 |
| ruby-lang | uri | >= 0.13.0 < 0.13.3 | 0.13.3 |
| ruby-lang | uri | >= 1.0.0 < 1.0.4 | 1.0.4 |
| ruby-lang | uri | >= 1.0.0 < 1.0.4 | 1.0.4 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.02.1LOWCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa5.3MEDIUM
osv5.3MEDIUM
vendor_debian3.2LOW
vendor_msrc3.2LOW
vendor_redhat3.2LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-61594: URI is a module providing classes to handle Uniform Resource Identifiers
osv·2025-12-30·CVSS 5.3
CVE-2025-61594 [MEDIUM] CVE-2025-61594: URI is a module providing classes to handle Uniform Resource Identifiers
URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.
OSV
URI Credential Leakage Bypass over CVE-2025-27221
osv·2025-12-30·CVSS 5.3
CVE-2025-61594 [MEDIUM] URI Credential Leakage Bypass over CVE-2025-27221
URI Credential Leakage Bypass over CVE-2025-27221
### Impact
In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.
When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.
The vulnerability affects the `uri` gem bundled with the following Ruby series:
* 0.12.4 and earlier (bundled in Ruby 3.2 series)
* 0.13.2 and earlier (bundled in Ruby 3.3 series)
* 1.0.3 and earlier (bundled in Ruby 3.4 series)
### Patches
Upgrade to 0.12.5, 0.13.3 or 1.0.4
### References
* https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/
* https://hackerone.com/reports/2957667
GHSA
URI Credential Leakage Bypass over CVE-2025-27221
ghsa·2025-12-30·CVSS 5.3
CVE-2025-61594 [MEDIUM] CWE-212 URI Credential Leakage Bypass over CVE-2025-27221
URI Credential Leakage Bypass over CVE-2025-27221
### Impact
In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.
When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.
The vulnerability affects the `uri` gem bundled with the following Ruby series:
* 0.12.4 and earlier (bundled in Ruby 3.2 series)
* 0.13.2 and earlier (bundled in Ruby 3.3 series)
* 1.0.3 and earlier (bundled in Ruby 3.4 series)
### Patches
Upgrade to 0.12.5, 0.13.3 or 1.0.4
### References
* https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/
* https://hackerone.com/reports/2957667
Ubuntu
Ruby vulnerability
vendor_ubuntu·2026-03-31
CVE-2025-61594 Ruby vulnerability
Title: Ruby vulnerability
Summary: Ruby could be made to expose sensitive information.
It was discovered that the Ruby URI gem did not properly handle sensitive
information when combining URIs. A remote attacker could possibly use this
issue to leak authentication credentials.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
uri: URI module: Credential exposure via URI + operator
vendor_redhat·2025-12-30·CVSS 3.2
CVE-2025-61594 [LOW] CWE-212 uri: URI module: Credential exposure via URI + operator
uri: URI module: Credential exposure via URI + operator
URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.
A flaw was found in the URI module. A remote attacker could exploit this vulnerability by using the `+` operator to combine Uniform Resource Identifiers (URIs). This bypasses a previous fix and can lead to the leakage of sensitive information, such as user credentials (passwords), from the ori
Microsoft
URI Credential Leakage Bypass over CVE-2025-27221
vendor_msrc·2025-12-09·CVSS 3.2
CVE-2025-61594 [LOW] CWE-212 URI Credential Leakage Bypass over CVE-2025-27221
URI Credential Leakage Bypass over CVE-2025-27221
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2025-61594: ruby2.7 - URI is a module providing classes to handle Uniform Resource Identifiers. In ver...
vendor_debian·2025·CVSS 3.2
CVE-2025-61594 [LOW] CVE-2025-61594: ruby2.7 - URI is a module providing classes to handle Uniform Resource Identifiers. In ver...
URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.
Scope: local
bullseye: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-61594 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 2.7
CVE-2025-61594 [LOW] CVE-2025-61594 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-61594 :
Ruby vulnerability analysis and mitigation
+
Source : NVD
## 2.7
Score
Published December 30, 2025
Severity LOW
CNA Score 2.7
Affected Technologies
Ruby
NixOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 3.3
Exploitation Probability (EPSS) N/A
Affected packages and libraries
gitlab-rails-ce-fips-18.1
rhel9::flatpak-sdk
Sources
NVD
AlmaLinux 8 Severity MEDIUM Has Fix Added at: Jan 08, 2026
AlmaLinux 9 Severity MEDIUM Has Fix Added at: Jan 08, 2026
Alpine 3.20, 3.21 Severity HIGH Has Fix Added at: Nov 23, 2025
Alpine 3.23 Severity HIGH Has Fix Added at: Dec 04, 2025
Alpine edge Severity HIGH Has Fix Added at: Nov 26, 2025
CBL-Mariner 2.0 Severity LOW H
Wiz
CVE-2025-10990 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.6
CVE-2025-10990 [MEDIUM] CVE-2025-10990 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-10990 :
Ruby Interpreter vulnerability analysis and mitigation
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
Source : NVD
## 7.5
Score
Published February 27, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
Ruby Interpreter
Linux Ubuntu
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 36.8
Exploitation Probability (EPSS) 0.2
Affected packages and l
Bugzilla
CVE-2025-61594 uri: URI module: Credential exposure via URI + operator
bugzilla·2025-12-30·CVSS 5.3
CVE-2025-61594 [MEDIUM] CVE-2025-61594 uri: URI module: Credential exposure via URI + operator
CVE-2025-61594 uri: URI module: Credential exposure via URI + operator
URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.
2025-12-30
Published