CVE-2025-61594: URI Credential Leakage Bypass over CVE-2025-27221
Impact
In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.
When using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.
The vulnerability affects the uri gem bundled with the following Ruby series:
0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series) 1.0.3 and earlier (bundled in Ruby 3.4 series)
Patches
Upgrade to 0.12.5, 0.13.3 or 1.0.4
References
https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/ https://hackerone.com/reports/2957667
Other sources
URI Credential Leakage Bypass over CVE-2025-27221
— Microsoft
URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.
— MITRE
URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61594?
CVE-2025-61594 is considered a high severity vulnerability due to the risk of exposing user credentials.
How do I fix CVE-2025-61594?
To fix CVE-2025-61594, update the uri package to version 1.0.4, 0.13.3, or 0.12.5.
What systems are affected by CVE-2025-61594?
CVE-2025-61594 affects versions of the uri package between 0.12.0 and 1.0.4.
What type of vulnerability is CVE-2025-61594?
CVE-2025-61594 is a credential exposure vulnerability caused by improper URI handling.
What potential impact does CVE-2025-61594 have on applications?
CVE-2025-61594 may lead to the unintentional leakage of sensitive information, such as user passwords, in applications.