CVE-2025-61594 - Vulnerability Details

- URI Credential Leakage Bypass over CVE-2025-27221

Description

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.

Published: 2025-12-30

Score: 2.1 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Ruby URI module allows classes to manipulate Uniform Resource Identifiers. In legacy versions, the + operator concatenated two URIs and inadvertently propagated the user name and password from the original URI to the resulting URI. This behavior violates RFC3986 and causes sensitive credentials to be exposed in logs or other logs, making applications vulnerable to credential leakage.

Affected Systems

The issue affects the Ruby URI gem versions 0.12.4 and earlier, 0.13.2 and earlier, and 1.0.3 and earlier—bundled in Ruby 3.2, 3.3, and 3.4 series respectively. Versions 0.12.5, 0.13.3, and 1.0.4 and later contain the fix.

Risk and Exploitability

The CVSS score is 2.1 and the EPSS score is less than 1%; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an application that concatenates URIs containing credentials via the + operator, which may be performed by code executing with trusted privileges. The impact is limited to information disclosure of credentials rather than code execution or denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ruby

uri

affected

Version	Status	Constraints
`< 0.12.5`	affected	—
`>= 0.13.0, < 0.13.3`	affected	—
`>= 1.0.0, < 1.0.4`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:ruby-lang:uri::::::ruby::*
	cpe:2.3:a:ruby-lang:uri::::::ruby::*
	cpe:2.3:a:ruby-lang:uri::::::ruby::*

No data.

Vendor	Product	Confidence	Versions
Ruby-lang	Uri	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Ruby URI gem to at least 0.12.5, 0.13.3, or 1.0.4—or update Ruby to a release that bundles the patched module.
If an upgrade cannot be performed immediately, remove or redact password components from any URI before performing concatenation or use alternative RFC‑compliant URI joining methods that do not propagate credentials.
Configure application logging to exclude or mask full URIs that may contain passwords, mitigating potential credential exposure in logs.

Generated by OpenCVE AI on April 20, 2026 at 15:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Github GHSA	GHSA-j4pr-3wm6-xx2r	URI Credential Leakage Bypass over CVE-2025-27221

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00009.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/advisories/GHSA-22h5-pq3x-2gf2
https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902
https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c
https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a
https://github.com/ruby/uri/security/advisories/GHSA-j4pr-3wm6-xx2r
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml
https://hackerone.com/reports/2957667
https://nvd.nist.gov/vuln/detail/CVE-2025-61594
https://www.cve.org/CVERecord?id=CVE-2025-61594
https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594/

History

Thu, 16 Apr 2026 17:30:00 +0000

Type	Values Removed	Values Added
Description	URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.	URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.
Weaknesses		CWE-200
References		https://github.com/advisories/GHSA-22h5-pq3x-2gf2 https://github.com/ruby/uri/security/advisories/GHSA-j4pr-3wm6-xx2r https://hackerone.com/reports/2957667 https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
Metrics	cvssV4_0 `{'score': 2.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U'}`	cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N'}`

Tue, 24 Feb 2026 15:00:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:ruby-lang:uri::::::ruby::*
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Mon, 05 Jan 2026 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Ruby-lang Ruby-lang uri
Vendors & Products		Ruby-lang Ruby-lang uri

Fri, 02 Jan 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2025-61594 https://www.cve.org/CVERecord?id=CVE-2025-61594
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}` threat_severity `Moderate`

Tue, 30 Dec 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 30 Dec 2025 21:15:00 +0000

Type	Values Removed	Values Added
Description		URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.
Title		URI Credential Leakage Bypass over CVE-2025-27221
Weaknesses		CWE-212
References		https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902 https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594/
Metrics		cvssV4_0 `{'score': 2.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U'}`

Subscriptions

Ruby-lang Uri

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2025-12-30T21:03:08.990Z

Updated: 2026-04-16T17:02:32.149Z

Reserved: 2025-09-26T16:25:25.150Z

Link: CVE-2025-61594

Vulnrichment

Updated: 2025-12-30T21:29:36.147Z

NVD

Status : Modified

Published: 2025-12-30T21:15:43.893

Modified: 2026-04-16T18:16:44.400

Link: CVE-2025-61594

Redhat

Severity : Moderate

Publid Date: 2025-12-30T21:03:08Z

Links: CVE-2025-61594 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-20T15:45:10Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object