CVE-2025-61594 - CVE House
Back to Database
Status published Low CVE-2025-61594

URI Credential Leakage Bypass over CVE-2025-27221

Vulnerability Description

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-61594

Credits & Attribution

No credits recorded in the NVD database.

References

More from ruby

View All →
CVE-2025-58767
REXML has a DoS condition when parsing malformed XML file
Low 1.2
CVE-2025-43857
net-imap rubygem vulnerable to possible DoS by memory exhaustion
Medium 6
CVE-2025-27788
Ruby JSON Parser has Out-of-bounds Read
High 7.5
CVE-2025-25186
Net::IMAP vulnerable to possible DoS by memory exhaustion
Medium 6.5
CVE-2024-49761
REXML ReDoS vulnerability
Medium 6.6

Affected Vendor

Affected Software

uri
Vulnerable Versions:
< 0.12.5, >= 0.13.0, < 0.13.3, >= 1.0.0, < 1.0.4

Timeline

Official Publish: December 30th, 2025
Last Modified: April 16th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-200 CWE-212

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration