ByteOS Network

NVD Vulnerability Details :

CVE-2025-27221

Analyzed

Source-cve@mitre.org

Published At-04 Mar, 2025 | 00:15

Updated At-01 Aug, 2025 | 02:06

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	3.2	LOW	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Primary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CPE Matches

Ruby

>>uri>>Versions before 0.11.3(exclusive)

cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*

Ruby

>>uri>>Versions from 0.12.0(inclusive) to 0.12.4(exclusive)

cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*

Ruby

>>uri>>Versions from 0.13.0(inclusive) to 0.13.2(exclusive)

cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*

Ruby

>>uri>>Versions from 1.0.0(inclusive) to 1.0.3(exclusive)

cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*

Weaknesses

CWE ID	Type	Source
CWE-212	Secondary	cve@mitre.org
CWE-212	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml	cve@mitre.org	Third Party Advisory
https://hackerone.com/reports/2957667	cve@mitre.org	Permissions Required

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History