URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.
CVSS Details
- CVSS 4.0 Base Score: 2.1 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygemsUpgrade rubygem-typeprofUpgrade rubygem-minitestUpgrade rubygem-raccUpgrade ruby-default-gemsUpgrade rubygems-develUpgrade rubygem-pg-docUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade rubygem-abrt-docUpgrade rubygem-irbUpgrade rubygem-io-consoleUpgrade rubygem-bundlerUpgrade rubygem-rbsUpgrade rubygem-rakeUpgrade rubygem-test-unitUpgrade rubyUpgrade rubygem-mysql2Upgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade rubygem-rssUpgrade rubygem-psychUpgrade ruby-libsUpgrade ruby-bundled-gemsUpgrade rubygem-jsonUpgrade rubygem-rexmlUpgrade rubygem-abrtUpgrade ruby-develUpgrade rubygem-rdoc | Jan 8, 2026 | Dec 10, 2025 |
| Alpine Linux | — | Upgrade ruby | Jan 5, 2026 | Dec 30, 2025 |
| Debian | — | Upgrade ruby2.7 | Aug 5, 2026 | Aug 5, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubygem-did_you_meanUpgrade rubygemsUpgrade ruby-helpUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade ruby-irbUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-bigdecimal | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade rubygem-io-consoleUpgrade ruby-helpUpgrade ruby-irbUpgrade rubyUpgrade rubygem-did_you_meanUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygems | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade ruby-helpUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubyUpgrade rubygem-did_you_meanUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-json | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade rubygem-io-consoleUpgrade ruby-helpUpgrade rubygem-rdocUpgrade rubygemsUpgrade ruby-irbUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-opensslUpgrade rubygem-did_you_mean | Feb 3, 2026 | Feb 2, 2026 |
| Redhat_linux | — | No solution existsUpgrade rubygem-racc-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-json-debuginfoUpgrade ruby-develUpgrade rubygem-rdocUpgrade rubygem-psych-debuginfoUpgrade rubygem-rakeUpgrade rubygem-bundlerUpgrade ruby-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-rssUpgrade rubygem-test-unitUpgrade ruby-docUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rexmlUpgrade rubygem-rbs-debuginfoUpgrade rubyUpgrade rubygem-irbUpgrade ruby-debugsourceUpgrade rubygem-abrt-docUpgrade rubygem-raccUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-jsonUpgrade rubygem-abrtUpgrade ruby-libs-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2Upgrade ruby-bundled-gemsUpgrade rubygem-typeprofUpgrade ruby-default-gemsUpgrade rubygem-rbsUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-libsUpgrade rubygem-pgUpgrade rubygems | Jan 5, 2026 | Dec 30, 2025 |
| Rocky_linux | — | Upgrade ruby-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rbsUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade ruby-bundled-gemsUpgrade ruby-libsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-raccUpgrade ruby-libs-debuginfoUpgrade ruby-debuginfoUpgrade rubygem-psych-debuginfoUpgrade rubygem-racc-debuginfoUpgrade ruby-develUpgrade rubygem-rbs-debuginfoUpgrade rubygem-pgUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-json-debuginfo | Feb 5, 2026 | Jan 3, 2026 |
| Ubuntu | — | Upgrade ruby2.7 (Ubuntu Pro)Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby3.2Upgrade libruby3.3Upgrade ruby3.2Upgrade ruby3.3Upgrade libruby2.7 (Ubuntu Pro)Upgrade ruby2.3 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade libruby3.0Upgrade ruby2.3-tcltk (Ubuntu Pro)Upgrade ruby3.0Upgrade libruby2.5 (Ubuntu Pro) | Apr 2, 2026 | Dec 30, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub