Logo
›
›vulnerability›CVE-2025-27221
Name
CVE-2025-27221
Source
NVD ( link)Debian ( link)
Description
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
CWEs
CWE-212 CWE-212
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.ymlThird Party Advisory
https://hackerone.com/reports/2957667Permissions Required

Analysis#

Affected Component
Analysis
ruby
Patched

Vulnerability Ratings#

3.2
CVSSv31
5.3
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
ruby
buildroot
2025.02.x
3.4.9
Not Affected
ruby
buildroot
master
4.0.3
Not Affected
ruby
openwrt
master
4.0.2-r1
Not Affected
ruby
openwrt
openwrt-25.12
3.4.9-r1
Not Affected
ruby
yocto
master
4.0.5
Not Affected
ruby
yocto
scarthgap
3.3.10
Not Affected

Resolved with patches#

ruby (yocto:kirkstone)

#
Title
Author
Resolve
1
Truncate userinfo with URI#join, URI#merge and URI#+
Hiroshi SHIBATA <hsbt@ruby-lang.org>
CVE-2025-27221
2
Fix merger of URI with authority component
Hiroshi SHIBATA <hsbt@ruby-lang.org>
CVE-2025-27221