Vulnerability · Published Mar 3, 2025 · Assigned by mitre
CVE-2025-27221
Low 3.2
In plain English
A low-severity security flaw in URI from ruby-lang. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.2Low
Exploit odds (30 days)0.5%top 56.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | ruby | 3.3.8-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | ruby | 3.1.7-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | ruby-bundled-gems | 3.1.7-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | ruby-bundled-gems | 3.3.8-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:10 | ruby-default-gems | 3.3.8-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux:8 | ruby-default-gems | 3.1.7-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | ruby-default-gems | 3.3.8-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | ruby-devel | 3.3.8-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | ruby-devel | 3.1.7-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:10 | ruby-doc | 3.3.8-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux:8 | ruby-doc | 3.3.8-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | ruby-doc | 3.1.7-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | ruby-libs | 3.1.7-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | ruby-libs | 3.3.8-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-abrt | 0.4.0-1.module_el8.10.0+3799+191214cc | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-abrt | 0.4.0-1.module_el8.9.0+3746+91b8233a | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-abrt-doc | 0.4.0-1.module_el8.10.0+3799+191214cc | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-abrt-doc | 0.4.0-1.module_el8.10.0+3854+02eaa59a | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-bigdecimal | 3.1.5-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-bigdecimal | 3.1.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:10 | rubygem-bundler | 2.5.22-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux:8 | rubygem-bundler | 2.5.22-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-bundler | 2.3.27-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-io-console | 0.7.1-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-io-console | 0.5.11-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:10 | rubygem-irb | 1.13.1-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux:8 | rubygem-irb | 1.13.1-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-irb | 1.4.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-json | 2.6.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-json | 2.7.2-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:10 | rubygem-minitest | 5.20.0-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux:8 | rubygem-minitest | 5.20.0-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-minitest | 5.15.0-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-mysql2 | 0.5.3-3.module_el8.10.0+3854+02eaa59a | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-mysql2 | 0.5.3-3.module_el8.9.0+3746+91b8233a | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-mysql2 | 0.5.5-1.module_el8.10.0+3799+191214cc | ALSA-2025:10217 |
| AlmaLinux:9 | rubygem-mysql2 | 0.5.4-1.module_el9.1.0+8+503f6fbd | ALSA-2025:4488 |
| AlmaLinux:8 | rubygem-mysql2-doc | 0.5.5-1.module_el8.10.0+3799+191214cc | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-mysql2-doc | 0.5.3-3.module_el8.10.0+3854+02eaa59a | ALSA-2025:4063 |
| AlmaLinux:9 | rubygem-mysql2-doc | 0.5.4-1.module_el9.1.0+8+503f6fbd | ALSA-2025:4488 |
| AlmaLinux:8 | rubygem-pg | 1.5.4-1.module_el8.10.0+3799+191214cc | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-pg | 1.3.2-1.module_el8.10.0+3854+02eaa59a | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-pg | 1.3.2-1.module_el8.9.0+3746+91b8233a | ALSA-2025:4063 |
| AlmaLinux:9 | rubygem-pg | 1.3.5-1.module_el9.1.0+8+503f6fbd | ALSA-2025:4488 |
| AlmaLinux:8 | rubygem-pg-doc | 1.5.4-1.module_el8.10.0+3799+191214cc | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-pg-doc | 1.3.2-1.module_el8.10.0+3854+02eaa59a | ALSA-2025:4063 |
| AlmaLinux:9 | rubygem-pg-doc | 1.3.5-1.module_el9.1.0+8+503f6fbd | ALSA-2025:4488 |
| AlmaLinux:10 | rubygem-power_assert | 2.0.3-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux:8 | rubygem-power_assert | 2.0.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-power_assert | 2.0.3-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-psych | 4.0.4-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-psych | 5.1.2-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-racc | 1.7.3-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:10 | rubygem-rake | 13.1.0-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux:8 | rubygem-rake | 13.1.0-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-rake | 13.0.6-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-rbs | 3.4.0-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-rbs | 2.7.0-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:10 | rubygem-rdoc | 6.6.3.1-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux:8 | rubygem-rdoc | 6.6.3.1-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | rubygem-rdoc | 6.4.1.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:10 | rubygem-rexml | 3.3.9-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux:8 | rubygem-rexml | 3.3.9-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-rexml | 3.3.9-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:10 | rubygem-rss | 0.3.1-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux:8 | rubygem-rss | 0.3.1-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-rss | 0.3.1-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:10 | rubygem-test-unit | 3.6.1-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux:8 | rubygem-test-unit | 3.5.3-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-test-unit | 3.6.1-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:10 | rubygem-typeprof | 0.21.9-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux:8 | rubygem-typeprof | 0.21.3-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:8 | rubygem-typeprof | 0.21.9-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:10 | rubygems | 3.5.22-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux:8 | rubygems | 3.5.22-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | rubygems | 3.3.27-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| AlmaLinux:10 | rubygems-devel | 3.5.22-10.el10_0 | ALSA-2025:8131 |
| AlmaLinux:8 | rubygems-devel | 3.5.22-4.module_el8.10.0+4022+8b66723c | ALSA-2025:10217 |
| AlmaLinux:8 | rubygems-devel | 3.3.27-145.module_el8.10.0+3984+cf55e3df | ALSA-2025:4063 |
| Debian:12 | ruby3.1 | no fix listed | DEBIAN-CVE-2025-27221 |
| Debian:13 | ruby3.3 | 3.3.7-2 | DEBIAN-CVE-2025-27221 |
| Debian:14 | ruby3.3 | 3.3.7-2 | DEBIAN-CVE-2025-27221 |
| Debian:12 | rubygems | 3.3.15-2+deb12u1 | DEBIAN-CVE-2025-27221 |
| Debian:13 | rubygems | 3.6.6-1 | DEBIAN-CVE-2025-27221 |
| Debian:14 | rubygems | 3.6.6-1 | DEBIAN-CVE-2025-27221 |
| Rocky Linux:10 | ruby | 0:3.3.8-10.el10_0 | RLSA-2025:8131 |
| Rocky Linux:8 | ruby | 0:3.1.7-145.module+el8.10.0+1957+16e0d1a2 | RLSA-2025:4063 |
| Rocky Linux:8 | ruby | 0:3.3.8-4.module+el8.10.0+2004+fd6e8d72 | RLSA-2025:10217 |
| Rocky Linux:9 | ruby | 0:3.1.7-146.module+el9.5.0+31847+8b291b93 | RLSA-2025:4488 |
| Rocky Linux:9 | ruby | 0:3.3.8-4.module+el9.6.0+31867+3a5bf654 | RLSA-2025:4493 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1826+b62220b4 | RLSA-2025:4063 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1827+16ecb9d2 | RLSA-2025:10217 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.5.0+668+665814fa | RLSA-2025:10217 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.9.0+1537+0b2034bd | RLSA-2025:10217 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1679+61871737 | RLSA-2025:10217 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1741+bdb5b6ca | RLSA-2025:10217 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1820+f3fffb92 | RLSA-2025:10217 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1826+b62220b4 | RLSA-2025:10217 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1827+16ecb9d2 | RLSA-2025:4063 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.5.0+668+665814fa | RLSA-2025:4063 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.9.0+1537+0b2034bd | RLSA-2025:4063 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1679+61871737 | RLSA-2025:4063 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1741+bdb5b6ca | RLSA-2025:4063 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1820+f3fffb92 | RLSA-2025:4063 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.3-3.module+el8.10.0+1744+6c504228 | RLSA-2025:4063 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.3-3.module+el8.10.0+1826+b62220b4 | RLSA-2025:4063 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.5-1.module+el8.10.0+1827+16ecb9d2 | RLSA-2025:10217 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.5-1.module+el8.10.0+1679+61871737 | RLSA-2025:10217 |
| Rocky Linux:9 | rubygem-mysql2 | 0:0.5.5-1.module+el9.6.0+31867+3a5bf654 | RLSA-2025:4493 |
| Rocky Linux:9 | rubygem-mysql2 | 0:0.5.4-1.module+el9.5.0+31847+8b291b93 | RLSA-2025:4488 |
| Rocky Linux:8 | rubygem-pg | 0:1.3.2-1.module+el8.10.0+1741+bdb5b6ca | RLSA-2025:4063 |
| Rocky Linux:8 | rubygem-pg | 0:1.3.2-1.module+el8.10.0+1826+b62220b4 | RLSA-2025:4063 |
| Rocky Linux:8 | rubygem-pg | 0:1.5.4-1.module+el8.10.0+1827+16ecb9d2 | RLSA-2025:10217 |
| Rocky Linux:8 | rubygem-pg | 0:1.5.4-1.module+el8.10.0+1679+61871737 | RLSA-2025:10217 |
| Rocky Linux:9 | rubygem-pg | 0:1.5.4-1.module+el9.6.0+31867+3a5bf654 | RLSA-2025:4493 |
| Rocky Linux:9 | rubygem-pg | 0:1.3.5-1.module+el9.5.0+31847+8b291b93 | RLSA-2025:4488 |
| RubyGems | uri | 0.13.2 | GHSA-22h5-pq3x-2gf2 |
| RubyGems | uri | 0.12.4 | GHSA-22h5-pq3x-2gf2 |
| RubyGems | uri | 0.11.3 | GHSA-22h5-pq3x-2gf2 |
| RubyGems | uri | 1.0.3 | GHSA-22h5-pq3x-2gf2 |
| Ubuntu:24.04:LTS | jruby | no fix listed | UBUNTU-CVE-2025-27221 |
| Ubuntu:25.10 | jruby | no fix listed | UBUNTU-CVE-2025-27221 |
| Ubuntu:26.04:LTS | jruby | no fix listed | UBUNTU-CVE-2025-27221 |
| Ubuntu:26.10 | jruby | no fix listed | UBUNTU-CVE-2025-27221 |
| Ubuntu:22.04:LTS | ruby3.0 | 3.0.2-7ubuntu2.10 | UBUNTU-CVE-2025-27221 |
| Ubuntu:22.04:LTS | ruby3.0 | 3.0.2-7ubuntu2.10 | USN-7418-1 |
| Ubuntu:24.04:LTS | ruby3.2 | 3.2.3-1ubuntu0.24.04.5 | UBUNTU-CVE-2025-27221 |
| Ubuntu:24.04:LTS | ruby3.2 | 3.2.3-1ubuntu0.24.04.5 | USN-7418-1 |
| Ubuntu:25.10 | ruby3.3 | 3.3.7-1ubuntu2 | UBUNTU-CVE-2025-27221 |
Affected products (as reported)
Weakness: CWE-212 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N