Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2025-61594

URI Credential Leakage Bypass over CVE-2025-27221

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Ruby-lang
Products
Uri
CVE-2023-36617

rubygem-uri: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

CVSS 3.1 · 5.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Redhat Ruby-lang
Products
Enterprise Linux Uri
CVE-2023-28755

ruby: ReDoS vulnerability in URI

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

CVSS 3.1 · 5.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 2 more
CVE-2025-27221

uri: userinfo leakage in URI#join, URI#merge and URI#+

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed
Vendors
Redhat Ruby-lang
Products
Enterprise Linux Uri