Vulnerability · Published Dec 30, 2025 · Assigned by GitHub_M
CVE-2025-61594URI Credential Leakage Bypass over CVE-2025-27221
Low 2.1
In plain English
A low-severity information exposure in uri from ruby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)2.1Low
Exploit odds (30 days)0.6%top 53.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | ruby | 3.3.10-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | ruby | 3.3.10-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:8 | ruby-bundled-gems | 3.3.10-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | ruby-bundled-gems | 3.3.10-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:10 | ruby-default-gems | 3.3.10-11.el10_1 | ALSA-2025:23141 |
| AlmaLinux:8 | ruby-default-gems | 3.3.10-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | ruby-default-gems | 3.3.10-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:8 | ruby-devel | 3.3.10-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | ruby-devel | 3.3.10-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:10 | ruby-doc | 3.3.10-11.el10_1 | ALSA-2025:23141 |
| AlmaLinux:8 | ruby-doc | 3.3.10-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | ruby-doc | 3.3.10-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:8 | ruby-libs | 3.3.10-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | ruby-libs | 3.3.10-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:8 | rubygem-abrt | 0.4.0-1.module_el8.10.0+3799+191214cc | ALSA-2025:23062 |
| AlmaLinux:8 | rubygem-abrt-doc | 0.4.0-1.module_el8.10.0+3799+191214cc | ALSA-2025:23062 |
| AlmaLinux:8 | rubygem-bigdecimal | 3.1.5-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-bigdecimal | 3.1.5-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:10 | rubygem-bundler | 2.5.22-11.el10_1 | ALSA-2025:23141 |
| AlmaLinux:8 | rubygem-bundler | 2.5.22-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-bundler | 2.5.22-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:8 | rubygem-io-console | 0.7.1-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-io-console | 0.7.1-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:10 | rubygem-irb | 1.13.1-11.el10_1 | ALSA-2025:23141 |
| AlmaLinux:8 | rubygem-irb | 1.13.1-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-irb | 1.13.1-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:8 | rubygem-json | 2.7.2-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-json | 2.7.2-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:10 | rubygem-minitest | 5.20.0-11.el10_1 | ALSA-2025:23141 |
| AlmaLinux:8 | rubygem-minitest | 5.20.0-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-minitest | 5.20.0-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:8 | rubygem-mysql2 | 0.5.5-1.module_el8.10.0+3799+191214cc | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-mysql2 | 0.5.5-3.module_el9.7.0+184+e2e36072 | ALSA-2025:23063 |
| AlmaLinux:8 | rubygem-mysql2-doc | 0.5.5-1.module_el8.10.0+3799+191214cc | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-mysql2-doc | 0.5.5-3.module_el9.7.0+184+e2e36072 | ALSA-2025:23063 |
| AlmaLinux:8 | rubygem-pg | 1.5.4-1.module_el8.10.0+3799+191214cc | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-pg | 1.5.4-1.module_el9.4.0+75+1a8fe981 | ALSA-2025:23063 |
| AlmaLinux:8 | rubygem-pg-doc | 1.5.4-1.module_el8.10.0+3799+191214cc | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-pg-doc | 1.5.4-1.module_el9.4.0+75+1a8fe981 | ALSA-2025:23063 |
| AlmaLinux:10 | rubygem-power_assert | 2.0.3-11.el10_1 | ALSA-2025:23141 |
| AlmaLinux:8 | rubygem-power_assert | 2.0.3-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-power_assert | 2.0.3-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:8 | rubygem-psych | 5.1.2-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-psych | 5.1.2-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:8 | rubygem-racc | 1.7.3-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-racc | 1.7.3-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:10 | rubygem-rake | 13.1.0-11.el10_1 | ALSA-2025:23141 |
| AlmaLinux:8 | rubygem-rake | 13.1.0-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-rake | 13.1.0-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:8 | rubygem-rbs | 3.4.0-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-rbs | 3.4.0-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:10 | rubygem-rdoc | 6.6.3.1-11.el10_1 | ALSA-2025:23141 |
| AlmaLinux:8 | rubygem-rdoc | 6.6.3.1-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-rdoc | 6.6.3.1-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:10 | rubygem-rexml | 3.4.4-11.el10_1 | ALSA-2025:23141 |
| AlmaLinux:8 | rubygem-rexml | 3.4.4-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-rexml | 3.4.4-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:10 | rubygem-rss | 0.3.1-11.el10_1 | ALSA-2025:23141 |
| AlmaLinux:8 | rubygem-rss | 0.3.1-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-rss | 0.3.1-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:10 | rubygem-test-unit | 3.6.1-11.el10_1 | ALSA-2025:23141 |
| AlmaLinux:8 | rubygem-test-unit | 3.6.1-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-test-unit | 3.6.1-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:10 | rubygem-typeprof | 0.21.9-11.el10_1 | ALSA-2025:23141 |
| AlmaLinux:8 | rubygem-typeprof | 0.21.9-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygem-typeprof | 0.21.9-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:10 | rubygems | 3.5.22-11.el10_1 | ALSA-2025:23141 |
| AlmaLinux:8 | rubygems | 3.5.22-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygems | 3.5.22-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| AlmaLinux:10 | rubygems-devel | 3.5.22-11.el10_1 | ALSA-2025:23141 |
| AlmaLinux:8 | rubygems-devel | 3.5.22-5.module_el8.10.0+4075+e5f6dad1 | ALSA-2025:23062 |
| AlmaLinux:9 | rubygems-devel | 3.5.22-5.module_el9.7.0+193+58179166 | ALSA-2025:23063 |
| Alpine:v3.20 | ruby | 3.3.10-r0 | ALPINE-CVE-2025-61594 |
| Alpine:v3.21 | ruby | 3.3.10-r0 | ALPINE-CVE-2025-61594 |
| Alpine:v3.22 | ruby | 3.4.7-r0 | ALPINE-CVE-2025-61594 |
| Alpine:v3.23 | ruby | 3.4.7-r0 | ALPINE-CVE-2025-61594 |
| Alpine:v3.24 | ruby | 3.4.7-r0 | ALPINE-CVE-2025-61594 |
| Debian:12 | ruby3.1 | no fix listed | DEBIAN-CVE-2025-61594 |
| Debian:13 | ruby3.3 | no fix listed | DEBIAN-CVE-2025-61594 |
| Debian:14 | ruby3.3 | no fix listed | DEBIAN-CVE-2025-61594 |
| Debian:12 | rubygems | no fix listed | DEBIAN-CVE-2025-61594 |
| Debian:13 | rubygems | no fix listed | DEBIAN-CVE-2025-61594 |
| Debian:14 | rubygems | no fix listed | DEBIAN-CVE-2025-61594 |
| Rocky Linux:10 | ruby | 0:3.3.10-11.el10_1 | RLSA-2025:23141 |
| Rocky Linux:8 | ruby | 0:3.3.10-5.module+el8.10.0+40038+e29e4152 | RLSA-2025:23062 |
| Rocky Linux:9 | ruby | 0:3.3.10-5.module+el9.7.0+40039+300ba1ed | RLSA-2025:23063 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1826+b62220b4 | RLSA-2025:23062 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1827+16ecb9d2 | RLSA-2025:23062 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.5.0+668+665814fa | RLSA-2025:23062 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1679+61871737 | RLSA-2025:23062 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.9.0+1537+0b2034bd | RLSA-2025:23062 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1741+bdb5b6ca | RLSA-2025:23062 |
| Rocky Linux:8 | rubygem-abrt | 0:0.4.0-1.module+el8.10.0+1820+f3fffb92 | RLSA-2025:23062 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.5-1.module+el8.10.0+1827+16ecb9d2 | RLSA-2025:23062 |
| Rocky Linux:8 | rubygem-mysql2 | 0:0.5.5-1.module+el8.10.0+1679+61871737 | RLSA-2025:23062 |
| Rocky Linux:9 | rubygem-mysql2 | 0:0.5.5-3.module+el9.7.0+40032+36e56d0d | RLSA-2025:23063 |
| Rocky Linux:8 | rubygem-pg | 0:1.5.4-1.module+el8.10.0+1679+61871737 | RLSA-2025:23062 |
| Rocky Linux:8 | rubygem-pg | 0:1.5.4-1.module+el8.10.0+1827+16ecb9d2 | RLSA-2025:23062 |
| Rocky Linux:9 | rubygem-pg | 0:1.5.4-1.module+el9.7.0+40032+36e56d0d.0.1 | RLSA-2025:23063 |
| RubyGems | uri | 1.0.4 | GHSA-j4pr-3wm6-xx2r |
| RubyGems | uri | 0.12.5 | GHSA-j4pr-3wm6-xx2r |
| RubyGems | uri | 0.13.3 | GHSA-j4pr-3wm6-xx2r |
| Ubuntu:22.04:LTS | ruby3.0 | 3.0.2-7ubuntu2.12 | UBUNTU-CVE-2025-61594 |
| Ubuntu:22.04:LTS | ruby3.0 | 3.0.2-7ubuntu2.12 | USN-8137-1 |
| Ubuntu:24.04:LTS | ruby3.2 | 3.2.3-1ubuntu0.24.04.7 | USN-8137-1 |
| Ubuntu:24.04:LTS | ruby3.2 | 3.2.3-1ubuntu0.24.04.7 | UBUNTU-CVE-2025-61594 |
| Ubuntu:25.10 | ruby3.3 | 3.3.8-2ubuntu2.1 | USN-8137-1 |
| Ubuntu:25.10 | ruby3.3 | 3.3.8-2ubuntu2.1 | UBUNTU-CVE-2025-61594 |
| Ubuntu:26.04:LTS | ruby3.3 | no fix listed | UBUNTU-CVE-2025-61594 |
| Ubuntu:26.10 | ruby3.3 | no fix listed | UBUNTU-CVE-2025-61594 |
Affected products (as reported)
Weakness: CWE-200, CWE-212 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
References
- https://github.com/ruby/uri/security/advisories/GHSA-j4pr-3wm6-xx2r x_refsource_CONFIRM
- https://hackerone.com/reports/2957667 x_refsource_MISC
- https://github.com/advisories/GHSA-22h5-pq3x-2gf2 x_refsource_MISC
- https://www.ruby-lang.org/en/news/2025/02/26/security-advisories x_refsource_MISC