What’s Vulnerable › Vulnerabilities

CVE-2025-61594: URI Credential Leakage Bypass over CVE-2025-27221

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-30 · updated 2026-06-17
• Weakness: CWE-200

Description

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.

Affected products

• ruby-lang URI: before 0.12.5; from 0.13.0 before 0.13.3; from 1.0.0 before 1.0.4 — fixed in 0.12.5, 0.13.3, 1.0.4

How to fix

Upgrade to a fixed version: ruby-lang URI 0.12.5, 0.13.3, 1.0.4. Check the vendor advisory for mitigations.

References

• https://github.com/advisories/GHSA-22h5-pq3x-2gf2
• https://github.com/ruby/uri/security/advisories/GHSA-j4pr-3wm6-xx2r
• https://hackerone.com/reports/2957667
• https://www.ruby-lang.org/en/news/2025/02/26/security-advisories

Get alerted when CVE-2025-61594 or the next vulnerability affects your stack