CVE-2025-27221

Published: Mar 4, 2025Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

Affected (4)

Products: Ruby Lang: Uri

Ruby Lang

1 product

Uri

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Ruby Lang Uri	Before 0.11.3
Ruby Lang Uri	From 0.12.0 to 0.12.4
Ruby Lang Uri	From 0.13.0 to 0.13.2
Ruby Lang Uri	From 1.0.0 to 1.0.3

Related CWEs

CWE-212

Improper Removal of Sensitive Information Before Storage or Transfer

The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

References (4)

https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml

Source: cve@mitre.org

Third Party Advisory

https://hackerone.com/reports/2957667

Source: cve@mitre.org

Permissions Required

https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.