Skip to content
Fencer Vulns
high 7.5

CVE-2025-61594 json

URI Credential Leakage Bypass over CVE-2025-27221

published 2025-12-30 10 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-205858 , GHSA-j4pr-3wm6-xx2r

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.

Patch / fix

  • rubygems uri 0.12.5, 0.13.3, 1.0.4
  • ruby-lang uri 0.12.5, 0.13.3, 1.0.4
  • ruby3.3 Debian 13 3.3.13-0+deb13u1

debian advisories DEBIAN-CVE-2025-61594

  • ruby3.0 Ubuntu 22.04 LTS 3.0.2-7ubuntu2.12
  • ruby3.2 Ubuntu 24.04 LTS 3.2.3-1ubuntu0.24.04.7
  • ruby3.3 Ubuntu 25.10 3.3.8-2ubuntu2.1
  • ruby2.3 Ubuntu Pro 16.04 LTS 2.3.1-2~ubuntu16.04.16+esm12
  • ruby2.5 Ubuntu Pro 18.04 LTS 2.5.1-1ubuntu1.16+esm7
  • ruby2.7 Ubuntu Pro 20.04 LTS 2.7.0-5ubuntu1.18+esm4

ubuntu advisories UBUNTU-CVE-2025-61594

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ruby RHEL 10.1 3.3.10-11.el10_1
  • rubygems RHEL 10.1 3.5.22-11.el10_1
  • ruby-libs RHEL 10.1 3.3.10-11.el10_1
  • rubygem-irb RHEL 10.1 1.13.1-11.el10_1
  • rubygem-rbs RHEL 10.1 3.4.0-11.el10_1
  • rubygem-rss RHEL 10.1 0.3.1-11.el10_1
  • rubygem-json RHEL 10.1 2.7.2-11.el10_1
  • rubygem-racc RHEL 10.1 1.7.3-11.el10_1

red hat advisories RHSA-2025:23141RHSA-2025:23062RHSA-2025:23063

  • ruby3.4 SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 3.4.10-150700.3.4.1

suse advisories SUSE-SU-2026:3090-1

  • ruby3.4 openSUSE Leap 16.0 3.4.10-160000.1.1
  • rubygem-uri openSUSE Tumbleweed 1.1.1-1.1
  • ruby3.4 openSUSE Tumbleweed 3.4.7-1.1

opensuse advisories openSUSE-SU-2026:21878-1openSUSE-SU-2026:11204-1openSUSE-SU-2025:15614-1

  • rubygems AlmaLinux 10 3.5.22-11.el10_1
  • rubygem-irb AlmaLinux 10 1.13.1-11.el10_1
  • rubygem-rss AlmaLinux 10 0.3.1-11.el10_1
  • rubygem-rake AlmaLinux 10 13.1.0-11.el10_1
  • rubygem-rdoc AlmaLinux 10 6.6.3.1-11.el10_1
  • rubygem-rexml AlmaLinux 10 3.4.4-11.el10_1
  • rubygem-bundler AlmaLinux 10 2.5.22-11.el10_1
  • rubygem-minitest AlmaLinux 10 5.20.0-11.el10_1

almalinux advisories ALSA-2025:23141ALSA-2025:23062ALSA-2025:23063

  • ruby Rocky Linux 10 3.3.10-11.el10_1
  • ruby Rocky Linux 9 3.3.10-5.module+el9.7.0+40039+300ba1ed
  • rubygem-pg Rocky Linux 9 1.5.4-1.module+el9.7.0+40032+36e56d0d.0.1
  • rubygem-mysql2 Rocky Linux 9 0.5.5-3.module+el9.7.0+40032+36e56d0d
  • ruby Rocky Linux 8 3.3.10-5.module+el8.10.0+40038+e29e4152
  • rubygem-pg Rocky Linux 8 1.5.4-1.module+el8.10.0+1679+61871737
  • rubygem-pg Rocky Linux 8 1.5.4-1.module+el8.10.0+1827+16ecb9d2
  • rubygem-abrt Rocky Linux 8 0.4.0-1.module+el8.10.0+1827+16ecb9d2

rocky linux advisories RLSA-2025:23141RLSA-2025:23063RLSA-2025:23062

  • ruby Alpine 3.21, Alpine 3.20 3.3.10-r0
  • ruby Alpine 3.24, Alpine 3.23, Alpine 3.22 3.4.7-r0

alpine advisories ALPINE-CVE-2025-61594

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ruby Azure Linux 3.0 3.3.5-7
  • ruby CBL-Mariner 2.0 3.1.7-4

azure linux advisories AZL-73356AZL-73391

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-61594 updated cvss 6.5

uri: URI module: Credential exposure via URI + operator

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/fluentd-rhel9 Red Hat Enterprise Linux 8 ruby, ruby-irb, rubygems, ruby-libs, rubygem-pg, rubygem-irb, +26 more Red Hat Enterprise Linux 9 ruby, rubygems, ruby-libs, rubygem-irb, rubygem-rbs, rubygem-rss, +15 more Red Hat Enterprise Linux 10 ruby, ubi10/ruby-33
    affected: no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
10 mo ago

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 2.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA 4.0 2.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
rubygems uri
<0.12.5
>=0.13.0, <0.13.3
>=1.0.0, <1.0.4
0.12.5
0.13.3
1.0.4

Affected products

  • ruby uri

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.