CVE-2025-61594

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-61594

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

U

RI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.

References
Link Resource
https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902 Patch
https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c Patch
https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a Patch
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml Vendor Advisory
https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*
cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*
cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*
History

24 Feb 2026, 14:57

Type Values Removed Values Added
CPE cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*
First Time Ruby-lang
Ruby-lang uri
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902 - () https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902 - Patch
References () https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c - () https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c - Patch
References () https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a - () https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a - Patch
References () https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml - () https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml - Vendor Advisory
References () https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594/ - () https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594/ - Vendor Advisory

30 Dec 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-30 21:15

Updated : 2026-02-24 14:57

NVD link : CVE-2025-61594

Mitre link : CVE-2025-61594

CVE.ORG link : CVE-2025-61594

JSON object : View

Products Affected

ruby-lang

CWE
CWE-212

Improper Removal of Sensitive Information Before Storage or Transfer