Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:deb/debian/rubygems@3.6.6-1?distro=trixie
Typedeb
Namespacedebian
Namerubygems
Version3.6.6-1
Qualifiers
distro trixie
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version3.6.7-2
Latest_non_vulnerable_version3.6.7-2
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-n1ja-n53g-fycm
vulnerability_id VCID-n1ja-n53g-fycm
summary 
URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+
There is a possibility for userinfo leakage by in the uri gem.
This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem.

## Details

The methods `URI#join`, `URI#merge`, and `URI#+` retained userinfo, such as `user:password`, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur.

Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later.

## Affected versions

uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2.

## Credits

Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue.
Also thanks to nobu for additional fixes of this vulnerability.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27221.json
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27221.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-27221
reference_id
reference_type
scores
0
value 0.00038
scoring_system epss
scoring_elements 0.11384
published_at 2026-04-02T12:55:00Z
1
value 0.00038
scoring_system epss
scoring_elements 0.1144
published_at 2026-04-04T12:55:00Z
2
value 0.00118
scoring_system epss
scoring_elements 0.30715
published_at 2026-04-07T12:55:00Z
3
value 0.00137
scoring_system epss
scoring_elements 0.33592
published_at 2026-04-16T12:55:00Z
4
value 0.00137
scoring_system epss
scoring_elements 0.33558
published_at 2026-04-13T12:55:00Z
5
value 0.00137
scoring_system epss
scoring_elements 0.33581
published_at 2026-04-12T12:55:00Z
6
value 0.00137
scoring_system epss
scoring_elements 0.33568
published_at 2026-04-18T12:55:00Z
7
value 0.00152
scoring_system epss
scoring_elements 0.35907
published_at 2026-04-11T12:55:00Z
8
value 0.00166
scoring_system epss
scoring_elements 0.37709
published_at 2026-04-09T12:55:00Z
9
value 0.00166
scoring_system epss
scoring_elements 0.37695
published_at 2026-04-08T12:55:00Z
10
value 0.00173
scoring_system epss
scoring_elements 0.38651
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-27221
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27221
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27221
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:38:46Z/
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml
5
reference_url https://github.com/ruby/uri
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri
6
reference_url https://github.com/ruby/uri/pull/154
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri/pull/154
7
reference_url https://github.com/ruby/uri/pull/155
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri/pull/155
8
reference_url https://github.com/ruby/uri/pull/156
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri/pull/156
9
reference_url https://github.com/ruby/uri/pull/157
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri/pull/157
10
reference_url https://hackerone.com/reports/2957667
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:38:46Z/
url https://hackerone.com/reports/2957667
11
reference_url https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html
12
reference_url https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html
13
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-27221
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-27221
14
reference_url https://www.cve.org/CVERecord?id=CVE-2025-27221
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements
1
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
2
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
3
value LOW
scoring_system generic_textual
scoring_elements
url https://www.cve.org/CVERecord?id=CVE-2025-27221
15
reference_url https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
16
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103794
reference_id 1103794
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103794
17
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2349700
reference_id 2349700
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2349700
18
reference_url https://github.com/advisories/GHSA-22h5-pq3x-2gf2
reference_id GHSA-22h5-pq3x-2gf2
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-22h5-pq3x-2gf2
19
reference_url https://access.redhat.com/errata/RHSA-2025:10217
reference_id RHSA-2025:10217
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:10217
20
reference_url https://access.redhat.com/errata/RHSA-2025:4063
reference_id RHSA-2025:4063
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4063
21
reference_url https://access.redhat.com/errata/RHSA-2025:4488
reference_id RHSA-2025:4488
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4488
22
reference_url https://access.redhat.com/errata/RHSA-2025:4493
reference_id RHSA-2025:4493
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4493
23
reference_url https://access.redhat.com/errata/RHSA-2025:8131
reference_id RHSA-2025:8131
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:8131
24
reference_url https://usn.ubuntu.com/7418-1/
reference_id USN-7418-1
reference_type
scores
url https://usn.ubuntu.com/7418-1/
25
reference_url https://usn.ubuntu.com/7442-1/
reference_id USN-7442-1
reference_type
scores
url https://usn.ubuntu.com/7442-1/
fixed_packages
0
url pkg:deb/debian/rubygems@3.2.5-2?distro=trixie
purl pkg:deb/debian/rubygems@3.2.5-2?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dy2a-n93k-yfgd
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/rubygems@3.2.5-2%3Fdistro=trixie
1
url pkg:deb/debian/rubygems@3.2.5-2%2Bdeb11u1?distro=trixie
purl pkg:deb/debian/rubygems@3.2.5-2%2Bdeb11u1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/rubygems@3.2.5-2%252Bdeb11u1%3Fdistro=trixie
2
url pkg:deb/debian/rubygems@3.3.15-2%2Bdeb12u1?distro=trixie
purl pkg:deb/debian/rubygems@3.3.15-2%2Bdeb12u1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/rubygems@3.3.15-2%252Bdeb12u1%3Fdistro=trixie
3
url pkg:deb/debian/rubygems@3.6.6-1?distro=trixie
purl pkg:deb/debian/rubygems@3.6.6-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/rubygems@3.6.6-1%3Fdistro=trixie
4
url pkg:deb/debian/rubygems@3.6.7-2?distro=trixie
purl pkg:deb/debian/rubygems@3.6.7-2?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/rubygems@3.6.7-2%3Fdistro=trixie
aliases CVE-2025-27221, GHSA-22h5-pq3x-2gf2
risk_score 1.6
exploitability 0.5
weighted_severity 3.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-n1ja-n53g-fycm
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:deb/debian/rubygems@3.6.6-1%3Fdistro=trixie