CVE-2025-61594

Published: Dic 30, 2025 Last Modified: Feb 24, 2026
ExploitDB:
Other exploit source:
Google Dorks:
LOW 2,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none

Description

AI Translation Available

URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0007
Percentile
0,2th
Updated

EPSS Score Trend (Last 75 Days)

212

Improper Removal of Sensitive Information Before Storage or Transfer

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Files Or Directories Read Application Data
Applicable Platforms
All platforms may be affected
View CWE Details
Application

Uri by Ruby-Lang

Product Information
Vendor Ruby-Lang
Product Uri
Version Range Affected
From 0.13.0 (inclusive)
To 0.13.3 (exclusive)
cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Uri by Ruby-Lang

Product Information
Vendor Ruby-Lang
Product Uri
Version Range Affected
To 0.12.5 (exclusive)
cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Uri by Ruby-Lang

Product Information
Vendor Ruby-Lang
Product Uri
Version Range Affected
From 1.0.0 (inclusive)
To 1.0.4 (exclusive)
cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/rubysec/ruby-advisory-db/blob/master/gem…
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594…
https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d966…
https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902
https://github.com/ruby/uri/commit/7e521b2da0833d964aab4301…
https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c
https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9…
https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a
https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-6…
https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594/