1. Home
  2. CVE Database
  3. CVE-2025-27221
LOW · 3.2

CVE-2025-27221

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing t...

Vulnerability Description

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

CVSS Score

3.2

LOW

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
Ruby-LangUri< 0.11.3

Related Weaknesses (CWE)

CWE-212

References

FAQ

What is CVE-2025-27221?

CVE-2025-27221 is a vulnerability with a CVSS score of 3.2 (LOW). In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing t...

How severe is CVE-2025-27221?

CVE-2025-27221 has been rated LOW with a CVSS base score of 3.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-27221?

Check the references section above for vendor advisories and patch information. Affected products include: Ruby-Lang Uri.