URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.
CVSS Details
- CVSS 4.0 Base Score: 2.1 (LOW)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-raccUpgrade rubygem-typeprofUpgrade rubygems-develUpgrade rubygem-minitestUpgrade rubygem-abrt-docUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-power_assertUpgrade ruby-default-gemsUpgrade rubygem-rbsUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade rubyUpgrade ruby-docUpgrade rubygem-rssUpgrade rubygem-mysql2Upgrade ruby-bundled-gemsUpgrade rubygem-test-unitUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-mysql2-docUpgrade rubygem-abrtUpgrade rubygem-jsonUpgrade rubygem-rakeUpgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-bundlerUpgrade rubygem-rexmlUpgrade ruby-libs | Jan 8, 2026 | Dec 10, 2025 |
| Alpine Linux | — | Upgrade ruby | Jan 5, 2026 | Dec 30, 2025 |
| Debian | — | Upgrade ruby2.7 | Aug 5, 2026 | Aug 5, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade rubygem-psychUpgrade rubygem-jsonUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade rubyUpgrade rubygem-rdocUpgrade rubygem-opensslUpgrade rubygem-did_you_meanUpgrade rubygemsUpgrade ruby-help | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade ruby-helpUpgrade rubygem-io-consoleUpgrade ruby-irbUpgrade rubyUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-opensslUpgrade rubygem-did_you_meanUpgrade rubygem-jsonUpgrade rubygemsUpgrade rubygem-psych | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade rubygem-jsonUpgrade rubygemsUpgrade rubygem-opensslUpgrade rubygem-rdocUpgrade rubygem-psychUpgrade rubyUpgrade ruby-helpUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-did_you_meanUpgrade ruby-irb | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade ruby-irbUpgrade ruby-helpUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-opensslUpgrade rubygem-psychUpgrade rubyUpgrade rubygem-did_you_meanUpgrade rubygem-json | Feb 3, 2026 | Feb 2, 2026 |
| Redhat_linux | — | Upgrade rubygem-irbUpgrade ruby-libsUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade ruby-libs-debuginfoUpgrade rubygem-abrt-docUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-raccUpgrade rubygem-abrtUpgrade rubyUpgrade ruby-debugsourceUpgrade rubygem-pg-debugsourceUpgrade rubygem-jsonUpgrade rubygem-typeprofUpgrade ruby-bundled-gemsUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade rubygemsUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rbsUpgrade rubygem-minitestUpgrade rubygem-pg-docUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-racc-debuginfoUpgrade rubygem-rdocUpgrade rubygem-bundlerUpgrade ruby-docUpgrade rubygem-test-unitUpgrade rubygem-rssUpgrade rubygem-io-consoleUpgrade rubygem-rexmlUpgrade rubygem-mysql2-debugsourceUpgrade rubygems-develUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade ruby-develUpgrade ruby-debuginfoUpgrade rubygem-psychUpgrade rubygem-rakeNo solution existsUpgrade rubygem-psych-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-json-debuginfo | Jan 5, 2026 | Dec 30, 2025 |
| Rocky_linux | — | Upgrade rubygem-io-consoleUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade rubygem-mysql2Upgrade rubygem-jsonUpgrade rubygem-pg-debugsourceUpgrade rubygem-rbsUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psychUpgrade ruby-bundled-gemsUpgrade rubyUpgrade ruby-debugsourceUpgrade rubygem-bigdecimalUpgrade rubygem-pg-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-pgUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade ruby-develUpgrade rubygem-psych-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-raccUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade ruby-debuginfo | Feb 5, 2026 | Jan 3, 2026 |
| Ubuntu | — | Upgrade ruby3.2Upgrade ruby2.7 (Ubuntu Pro)Upgrade libruby3.3Upgrade libruby3.2Upgrade ruby2.5 (Ubuntu Pro)Upgrade libruby2.7 (Ubuntu Pro)Upgrade libruby2.3 (Ubuntu Pro)Upgrade ruby3.3Upgrade libruby3.0Upgrade libruby2.5 (Ubuntu Pro)Upgrade ruby2.3-tcltk (Ubuntu Pro)Upgrade ruby3.0Upgrade ruby2.3 (Ubuntu Pro) | Apr 2, 2026 | Dec 30, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub