Vulnerability Description
URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ruby-Lang | Uri | < 0.12.5 |
Related Weaknesses (CWE)
References
- https://github.com/advisories/GHSA-22h5-pq3x-2gf2
- https://github.com/ruby/uri/security/advisories/GHSA-j4pr-3wm6-xx2r
- https://hackerone.com/reports/2957667
- https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
FAQ
What is CVE-2025-61594?
CVE-2025-61594 is a vulnerability with a CVSS score of 7.5 (HIGH). URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier...
How severe is CVE-2025-61594?
CVE-2025-61594 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-61594?
Check the references section above for vendor advisories and patch information. Affected products include: Ruby-Lang Uri.