Skip to content
Sign in
3.2 Low

CVE-2025-27221 In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent…

Description

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

Affected products and versions

Product Affected versions Fixed in
URI 1.0 1.0.0 → < 1.0.3 1.0.3
URI 0.13 0.13.0 → < 0.13.2 0.13.2
URI 0.12 0.12.0 → < 0.12.4 0.12.4
URI 0.11 earliest → < 0.11.3 0.11.3
Track this CVE