Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (1)
| Vulnerability |
Summary |
Aliases |
|
VCID-nw8a-e25n-mbgs
|
URI Credential Leakage Bypass over CVE-2025-27221
In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.
When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.
The vulnerability affects the `uri` gem bundled with the following Ruby series:
* 0.12.4 and earlier (bundled in Ruby 3.2 series)
* 0.13.2 and earlier (bundled in Ruby 3.3 series)
* 1.0.3 and earlier (bundled in Ruby 3.4 series)
|
CVE-2025-61594
GHSA-j4pr-3wm6-xx2r
|