CVE-2025-27221: Infoleak
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
Other sources
There is a possibility for userinfo leakage by in the uri gem. This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem.
Details
The methods URI#join, URI#merge, and URI#+ retained userinfo, such as user:password, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur.
Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later.
Affected versions
uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2.
Credits
Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue. Also thanks to nobu for additional fixes of this vulnerability.
— GitHub
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27221?
CVE-2025-27221 poses a risk of userinfo leakage, which can lead to unauthorized access to sensitive information.
How do I fix CVE-2025-27221?
To remediate CVE-2025-27221, upgrade the uri gem to version 1.0.3, 0.13.2, 0.12.4, or 0.11.3 as applicable.
What is the impact of CVE-2025-27221 on my application?
CVE-2025-27221 can lead to leaking sensitive user credentials, compromising user privacy and security.
Which versions of the uri gem are affected by CVE-2025-27221?
CVE-2025-27221 affects versions of the uri gem prior to 1.0.3, 0.13.2, 0.12.4, and 0.11.3.
Is there a workaround for CVE-2025-27221 if I cannot upgrade?
No specific workarounds are recommended for CVE-2025-27221; upgrading to the fixed versions is the only effective solution.