{"id":"CVE-2025-61594","aliases":["GHSA-j4pr-3wm6-xx2r"],"url":"https://o3.security/vulnerability/CVE-2025-61594","summary":"URI Credential Leakage Bypass over CVE-2025-27221","details":"### Impact\n\nIn affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.\n\nWhen using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.\n\nThe vulnerability affects the `uri` gem bundled with the following Ruby series:\n\n* 0.12.4 and earlier (bundled in Ruby 3.2 series)\n* 0.13.2 and earlier (bundled in Ruby 3.3 series)\n* 1.0.3 and earlier (bundled in Ruby 3.4 series)\n\n### Patches\n\nUpgrade to 0.12.5, 0.13.3 or 1.0.4\n\n### References\n\n* https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/\n* https://hackerone.com/reports/2957667","published":"2025-12-30T21:03:08.990Z","modified":"2026-10-29T11:42:18.761269244Z","cvss":null,"epss":{"score":0.00531,"percentile":0.42475,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"uri","fixedVersion":"0.12.5"},{"ecosystem":"RubyGems","name":"uri","fixedVersion":"0.13.3"},{"ecosystem":"RubyGems","name":"uri","fixedVersion":"1.0.4"}],"fix":{"url":"https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902","label":"ruby/uri@20157e3"},"references":[{"type":"WEB","url":"https://hackerone.com/reports/2957667"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61594.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-22h5-pq3x-2gf2"},{"type":"ADVISORY","url":"https://github.com/ruby/uri/security/advisories/GHSA-j4pr-3wm6-xx2r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61594"},{"type":"ADVISORY","url":"https://www.ruby-lang.org/en/news/2025/02/26/security-advisories"},{"type":"WEB","url":"https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902"},{"type":"WEB","url":"https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c"},{"type":"WEB","url":"https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a"},{"type":"PACKAGE","url":"https://github.com/ruby/uri"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml"},{"type":"WEB","url":"https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-29T11:42:18.761269244Z"}}