CVE-2025-27221

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-27221
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27221.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-27221
Aliases
Downstream
AZL (2)
CGA (98)
CLEANSTART (2)
CLSA (4)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (14)
OESA (5)
RHSA (5)
RLSA (5)
SUSE (3)
UBUNTU (1)
Related
ALSA (4)
CGA (1)
SUSE (3)
Published
2025-03-03T00:00:00Z
Modified
2026-08-12T03:51:36Z
Severity
  • 3.2 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

Database specific 
{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-212"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27221.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "0.11.3"
                },
                {
                    "introduced":  "0.12.0"
                },
                {
                    "fixed":  "0.12.4"
                },
                {
                    "introduced":  "0.13.0"
                },
                {
                    "fixed":  "0.13.2"
                },
                {
                    "introduced":  "1.0.0"
                },
                {
                    "fixed":  "1.0.3"
                }
            ],
            "source":  "AFFECTED_FIELD"
        },
        {
            "extracted_events":  [
                {
                    "fixed":  "0.11.3"
                },
                {
                    "introduced":  "0.12.0"
                },
                {
                    "fixed":  "0.12.4"
                },
                {
                    "introduced":  "0.13.0"
                },
                {
                    "fixed":  "0.13.2"
                },
                {
                    "introduced":  "1.0.0"
                },
                {
                    "fixed":  "1.0.3"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "extracted_events":  [
                {
                    "fixed":  "1.0.3"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/ruby/uri

Affected ranges

Type
GIT
Repo
https://github.com/ruby/uri
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c13dfc2164bc4af31085e709ab348fdbd527013f
Introduced
72f22716f86fe6bccf52c167cbb30e1a6e70aaca
Fixed
b079fb331eba7254d13e5e3c7e1853f9b28fc63a
Introduced
b50d37f7a193991c56bda7f94e8dd6fec0bb3f7f
Fixed
cef02d63f5e0d7685631e0ed9324b2801784c871
Introduced
af8d9d6bb1a90da71f64a9c3f8eddd3626d44efb
Fixed
3213f4a0f80f10c8f36993dbb9eabe7f2c1b50fd
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.11.3"
        },
        {
            "introduced":  "0.12.0"
        },
        {
            "fixed":  "0.12.4"
        },
        {
            "introduced":  "0.13.0"
        },
        {
            "fixed":  "0.13.2"
        },
        {
            "introduced":  "1.0.0"
        },
        {
            "fixed":  "1.0.3"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.11.0
v0.11.1
v0.11.2
v0.12.0
v0.12.1
v0.12.2
v0.12.3
v0.13.0
v0.13.1
v1.*
v1.0.0
v1.0.1
v1.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27221.json"