CVE-2025-61594

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/advisories/GHSA-22h5-pq3x-2gf2
https://github.com/ruby/uri/security/advisories/GHSA-j4pr-3wm6-xx2r
https://hackerone.com/reports/2957667
https://www.ruby-lang.org/en/news/2025/02/26/security-advisories

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ruby-lang:uri::::::ruby::*
	cpe:2.3:a:ruby-lang:uri::::::ruby::*
	cpe:2.3:a:ruby-lang:uri::::::ruby::*

History

No history.

Information

Published : 2025-12-30 21:15

Updated : 2026-06-17 09:50

NVD link : CVE-2025-61594

Mitre link : CVE-2025-61594

CVE.ORG link : CVE-2025-61594

JSON object : View

Products Affected

ruby-lang

uri

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-212

Improper Removal of Sensitive Information Before Storage or Transfer

{"id": "CVE-2025-61594", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61594", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-30T21:29:32.513492Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ruby", "product": "uri", "versions": [{"status": "affected", "version": "< 0.12.5"}, {"status": "affected", "version": ">= 0.13.0, < 0.13.3"}, {"status": "affected", "version": ">= 1.0.0, < 1.0.4"}]}]}], "published": "2025-12-30T21:15:43.893", "references": [{"url": "https://github.com/advisories/GHSA-22h5-pq3x-2gf2", "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/uri/security/advisories/GHSA-j4pr-3wm6-xx2r", "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/2957667", "source": "security-advisories@github.com"}, {"url": "https://www.ruby-lang.org/en/news/2025/02/26/security-advisories", "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-212"}]}], "descriptions": [{"lang": "en", "value": "URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4."}, {"lang": "es", "value": "URI es un m\u00f3dulo que proporciona clases para manejar Identificadores Uniformes de Recursos. En versiones anteriores a 0.12.5, 0.13.3 y 1.0.4, existe un bypass para la correcci\u00f3n de CVE-2025-27221 que puede exponer credenciales de usuario. Al usar el operador '+' para combinar URIs, informaci\u00f3n sensible como contrase\u00f1as del URI original puede filtrarse, violando RFC3986 y haciendo que las aplicaciones sean vulnerables a la exposici\u00f3n de credenciales. Las versiones 0.12.5, 0.13.3 y 1.0.4 corrigen el problema."}], "lastModified": "2026-06-17T09:50:37.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "488EF0F7-7510-451A-9EFC-85673ADC364D", "versionEndExcluding": "0.12.5"}, {"criteria": "cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "336CB58A-5975-4516-86A6-FAC69551C4A3", "versionEndExcluding": "0.13.3", "versionStartIncluding": "0.13.0"}, {"criteria": "cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "7930C9E3-5EEA-40F9-8299-25B6C681BAD6", "versionEndExcluding": "1.0.4", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}