Ruby URI gem CVE-2025-61594
LOWSeverity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector because credentials are exfiltrated to a remote host; AC:H and UI:R reflect AT:P preconditions requiring specific application URI-combination behavior; S:C because credential impact falls on a subsequent system.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.
AnalysisAI
Credential leakage in the Ruby URI gem's + operator allows sensitive userinfo (username and password embedded in URIs) to persist when the host portion of a URI is replaced, violating RFC3986. This flaw affects URI gem versions bundled across the Ruby 3.2, 3.3, and 3.4 release series and represents a bypass of the prior fix for CVE-2025-27221, which patched equivalent behavior in URI#join and URI#merge but left URI#+ unaddressed. No public exploit code has been identified and EPSS is 0.01%, but applications that embed credentials in URIs and dynamically combine them using + are concretely at risk of sending those credentials to attacker-controlled hosts.
Technical ContextAI
The Ruby standard library ships a bundled uri gem (cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*) for parsing and manipulating RFC3986 URIs. The + operator is intended to resolve a relative reference against a base URI, analogous to how browsers resolve relative links. The root cause (CWE-200, Exposure of Sensitive Information) is that the implementation fails to strip the userinfo component (the user:password@ segment) from the base URI when the resulting combined URI targets a different host. CVE-2025-27221 previously patched URI#join and URI#merge for the same class of defect, but the + operator, which shares similar resolution logic, was not patched in the same fix cycle, creating this bypass. The three affected release branches correspond to gem versions ≤0.12.4 (Ruby 3.2 series), ≤0.13.2 (Ruby 3.3 series), and ≤1.0.3 (Ruby 3.4 series).
RemediationAI
Upgrade the uri gem to the patched versions: 0.12.5 for Ruby 3.2 series, 0.13.3 for Ruby 3.3 series, or 1.0.4 for Ruby 3.4 series. Run gem update uri or update the gem constraint in your Gemfile to gem 'uri', '>= 0.12.5' (adjusting for your Ruby series), then run bundle update uri. Upstream fix pull requests are available at https://github.com/ruby/uri/pull/154 and https://github.com/ruby/uri/pull/155. As a compensating control where immediate patching is not feasible, audit application code for any use of the URI#+ operator on URIs that contain embedded userinfo and refactor to strip credentials before performing URI combination - for example, by zeroing uri.userinfo = nil on the base URI prior to calling +. This eliminates the leakage path without requiring a gem upgrade. Note that stripping userinfo before combination may break authentication flows that depend on credential propagation, so verify application behavior after applying the control.
lambdaisland/uri is a pure Clojure/ClojureScript URI library. Rated medium severity (CVSS 6.1), this vulnerability is re
A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. Rated medium severity (CVSS 5.3), this vulnera
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. Rated medium severity (CVSS 5.3)
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today