Ruby URI gem CVE-2025-61594

Exploitation requires three concurrent conditions: (1) the application must construct or receive a URI containing embedded userinfo credentials in the user:password@host format; (2) application code must invoke the URI#+ operator using that credential-bearing URI as the left-hand operand; and (3) the right-hand operand (the URI being combined) must resolve to a different host than the base - either through attacker-supplied input or a redirect. Exploitation is limited to the Ruby 3.2, 3.3, and 3.4 release series on URI gem versions below the fix thresholds. Applications that never embed credentials in URI objects, or that use string interpolation or manual URI construction rather than the + operator, are not affected. The CVSS 4.0 AT:P (attack requirements present) and AV:L confirm that specific application behavior is a prerequisite, not a default-configuration exposure.

Multiple signals converge on a low real-world risk rating. The CVSS 4.0 base score is 2.1 (AV:L/AT:P/SC:L), reflecting that attack preconditions are specific (AT:P) and consequential system impact is limited (SC:L). EPSS is 0.01% at the 3rd percentile, indicating extremely low observed exploitation probability compared to all CVEs. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified. However, the risk is non-trivial for applications that: (1) construct URIs with embedded credentials, and (2) use the + operator to resolve paths against those URIs in contexts where the host can be influenced by external input. In such scenarios, credentials could silently be forwarded to an attacker-controlled server - a pattern common in HTTP client libraries, redirect-following code, or webhook processors. The bypass nature of this CVE (circumventing the CVE-2025-27221 fix) suggests that security-conscious teams who already patched the prior issue may have reintroduced exposure through this vector. Low EPSS and absent KEV status do not reduce the need for patching; they simply indicate the issue has not been broadly weaponized to date.

An HTTP client library or redirect-handling component in a Ruby application stores an authenticated base URI (e.g., https://user:secret@api.internal/v1/) and uses the + operator to resolve a relative path returned in a server response or user-supplied input (e.g., //attacker.example/harvest). The resulting URI retains the original userinfo, producing https://user:secret@attacker.example/harvest, which the application then requests - sending credentials to the attacker's server in the Authorization header or URI. No public proof-of-concept exists for this specific bypass, but the attack pattern is mechanically identical to that documented for CVE-2025-27221.