Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u5?distro=bullseye
Typedeb
Namespacedebian
Nameruby2.7
Version2.7.4-1+deb11u5
Qualifiers
distro bullseye
Subpath
Is_vulnerablefalse
Next_non_vulnerable_versionnull
Latest_non_vulnerable_versionnull
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-exq5-cnrm-3uhd
vulnerability_id VCID-exq5-cnrm-3uhd
summary 
CGI has Denial of Service (DoS) potential in Cookie.parse
There is a possibility for DoS by in the cgi gem.
This vulnerability has been assigned the CVE identifier CVE-2025-27219. We recommend upgrading the cgi gem.

## Details

CGI::Cookie.parse took super-linear time to parse a cookie string in some cases. Feeding a maliciously crafted cookie string into the method could lead to a Denial of Service.

Please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.

## Affected versions

cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.

## Credits

Thanks to lio346 for discovering this issue.
Also thanks to mame for fixing this vulnerability.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27219.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27219.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-27219
reference_id
reference_type
scores
0
value 0.00316
scoring_system epss
scoring_elements 0.54661
published_at 2026-04-12T12:55:00Z
1
value 0.00316
scoring_system epss
scoring_elements 0.54679
published_at 2026-04-18T12:55:00Z
2
value 0.00316
scoring_system epss
scoring_elements 0.54678
published_at 2026-04-16T12:55:00Z
3
value 0.00316
scoring_system epss
scoring_elements 0.5464
published_at 2026-04-13T12:55:00Z
4
value 0.00349
scoring_system epss
scoring_elements 0.57364
published_at 2026-04-24T12:55:00Z
5
value 0.00349
scoring_system epss
scoring_elements 0.57444
published_at 2026-04-11T12:55:00Z
6
value 0.00349
scoring_system epss
scoring_elements 0.57366
published_at 2026-04-29T12:55:00Z
7
value 0.00349
scoring_system epss
scoring_elements 0.57386
published_at 2026-04-26T12:55:00Z
8
value 0.00349
scoring_system epss
scoring_elements 0.57409
published_at 2026-04-21T12:55:00Z
9
value 0.00387
scoring_system epss
scoring_elements 0.59789
published_at 2026-05-05T12:55:00Z
10
value 0.00387
scoring_system epss
scoring_elements 0.59837
published_at 2026-05-07T12:55:00Z
11
value 0.00416
scoring_system epss
scoring_elements 0.6169
published_at 2026-04-09T12:55:00Z
12
value 0.00416
scoring_system epss
scoring_elements 0.61675
published_at 2026-04-08T12:55:00Z
13
value 0.00623
scoring_system epss
scoring_elements 0.70084
published_at 2026-04-07T12:55:00Z
14
value 0.00778
scoring_system epss
scoring_elements 0.73631
published_at 2026-04-04T12:55:00Z
15
value 0.00778
scoring_system epss
scoring_elements 0.73608
published_at 2026-04-02T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-27219
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27219
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27219
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/ruby/cgi
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/cgi
5
reference_url https://github.com/ruby/cgi/pull/52
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/cgi/pull/52
6
reference_url https://github.com/ruby/cgi/pull/53
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/cgi/pull/53
7
reference_url https://github.com/ruby/cgi/pull/54
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/cgi/pull/54
8
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:41:05Z/
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml
9
reference_url https://hackerone.com/reports/2936778
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:41:05Z/
url https://hackerone.com/reports/2936778
10
reference_url https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-27219
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-27219
12
reference_url https://www.cve.org/CVERecord?id=CVE-2025-27219
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3
scoring_elements
1
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
2
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.cve.org/CVERecord?id=CVE-2025-27219
13
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103792
reference_id 1103792
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103792
14
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2349699
reference_id 2349699
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2349699
15
reference_url https://github.com/advisories/GHSA-gh9q-2xrm-x6qv
reference_id GHSA-gh9q-2xrm-x6qv
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-gh9q-2xrm-x6qv
16
reference_url https://access.redhat.com/errata/RHSA-2025:10217
reference_id RHSA-2025:10217
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:10217
17
reference_url https://access.redhat.com/errata/RHSA-2025:4063
reference_id RHSA-2025:4063
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4063
18
reference_url https://access.redhat.com/errata/RHSA-2025:4487
reference_id RHSA-2025:4487
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4487
19
reference_url https://access.redhat.com/errata/RHSA-2025:4488
reference_id RHSA-2025:4488
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4488
20
reference_url https://access.redhat.com/errata/RHSA-2025:4493
reference_id RHSA-2025:4493
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4493
21
reference_url https://access.redhat.com/errata/RHSA-2025:8131
reference_id RHSA-2025:8131
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:8131
22
reference_url https://usn.ubuntu.com/7418-1/
reference_id USN-7418-1
reference_type
scores
url https://usn.ubuntu.com/7418-1/
23
reference_url https://usn.ubuntu.com/7442-1/
reference_id USN-7442-1
reference_type
scores
url https://usn.ubuntu.com/7442-1/
fixed_packages
0
url pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye
purl pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye
1
url pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u5?distro=bullseye
purl pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u5?distro=bullseye
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u5%3Fdistro=bullseye
aliases CVE-2025-27219, GHSA-gh9q-2xrm-x6qv
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-exq5-cnrm-3uhd
1
url VCID-h4mf-99f4-9bdw
vulnerability_id VCID-h4mf-99f4-9bdw
summary 
CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement
There is a possibility for Regular expression Denial of Service (ReDoS) by in the cgi gem. This vulnerability has been assigned the CVE identifier CVE-2025-27220. We recommend upgrading the cgi gem.

## Details

The regular expression used in `CGI::Util#escapeElement` is vulnerable to ReDoS. The crafted input could lead to a high CPU consumption.

This vulnerability only affects Ruby 3.1 and 3.2. If you are using these versions, please update CGI gem to version 0.3.5.1, 0.3.7, 0.4.2 or later.

## Affected versions

cgi gem versions <= 0.3.5, 0.3.6, 0.4.0 and 0.4.1.

## Credits

Thanks to svalkanov for discovering this issue.
Also thanks to nobu for fixing this vulnerability.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27220.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27220.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-27220
reference_id
reference_type
scores
0
value 0.00181
scoring_system epss
scoring_elements 0.39805
published_at 2026-04-13T12:55:00Z
1
value 0.00181
scoring_system epss
scoring_elements 0.39827
published_at 2026-04-18T12:55:00Z
2
value 0.00181
scoring_system epss
scoring_elements 0.39855
published_at 2026-04-16T12:55:00Z
3
value 0.00181
scoring_system epss
scoring_elements 0.39822
published_at 2026-04-12T12:55:00Z
4
value 0.002
scoring_system epss
scoring_elements 0.42161
published_at 2026-04-11T12:55:00Z
5
value 0.00246
scoring_system epss
scoring_elements 0.47759
published_at 2026-05-05T12:55:00Z
6
value 0.00246
scoring_system epss
scoring_elements 0.47826
published_at 2026-05-07T12:55:00Z
7
value 0.00253
scoring_system epss
scoring_elements 0.48629
published_at 2026-04-26T12:55:00Z
8
value 0.00253
scoring_system epss
scoring_elements 0.48634
published_at 2026-04-21T12:55:00Z
9
value 0.00253
scoring_system epss
scoring_elements 0.48579
published_at 2026-04-29T12:55:00Z
10
value 0.00253
scoring_system epss
scoring_elements 0.48618
published_at 2026-04-24T12:55:00Z
11
value 0.00282
scoring_system epss
scoring_elements 0.51609
published_at 2026-04-09T12:55:00Z
12
value 0.00282
scoring_system epss
scoring_elements 0.51613
published_at 2026-04-08T12:55:00Z
13
value 0.00483
scoring_system epss
scoring_elements 0.65173
published_at 2026-04-07T12:55:00Z
14
value 0.00566
scoring_system epss
scoring_elements 0.68425
published_at 2026-04-04T12:55:00Z
15
value 0.00566
scoring_system epss
scoring_elements 0.68405
published_at 2026-04-02T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-27220
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27220
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27220
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/ruby/cgi
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/cgi
5
reference_url https://github.com/ruby/cgi/pull/52
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/cgi/pull/52
6
reference_url https://github.com/ruby/cgi/pull/53
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/cgi/pull/53
7
reference_url https://github.com/ruby/cgi/pull/54
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/cgi/pull/54
8
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27220.yml
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
2
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:39:36Z/
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27220.yml
9
reference_url https://hackerone.com/reports/2890322
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
2
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:39:36Z/
url https://hackerone.com/reports/2890322
10
reference_url https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-27220
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-27220
12
reference_url https://www.cve.org/CVERecord?id=CVE-2025-27220
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3
scoring_elements
1
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
2
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.cve.org/CVERecord?id=CVE-2025-27220
13
reference_url https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
1
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
14
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103793
reference_id 1103793
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103793
15
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2349696
reference_id 2349696
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2349696
16
reference_url https://github.com/advisories/GHSA-mhwm-jh88-3gjf
reference_id GHSA-mhwm-jh88-3gjf
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mhwm-jh88-3gjf
17
reference_url https://access.redhat.com/errata/RHSA-2025:4063
reference_id RHSA-2025:4063
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4063
18
reference_url https://access.redhat.com/errata/RHSA-2025:4487
reference_id RHSA-2025:4487
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4487
19
reference_url https://access.redhat.com/errata/RHSA-2025:4488
reference_id RHSA-2025:4488
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4488
20
reference_url https://usn.ubuntu.com/7418-1/
reference_id USN-7418-1
reference_type
scores
url https://usn.ubuntu.com/7418-1/
21
reference_url https://usn.ubuntu.com/7442-1/
reference_id USN-7442-1
reference_type
scores
url https://usn.ubuntu.com/7442-1/
fixed_packages
0
url pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye
purl pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye
1
url pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u5?distro=bullseye
purl pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u5?distro=bullseye
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u5%3Fdistro=bullseye
aliases CVE-2025-27220, GHSA-mhwm-jh88-3gjf
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-h4mf-99f4-9bdw
2
url VCID-n1ja-n53g-fycm
vulnerability_id VCID-n1ja-n53g-fycm
summary 
URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+
There is a possibility for userinfo leakage by in the uri gem.
This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem.

## Details

The methods `URI#join`, `URI#merge`, and `URI#+` retained userinfo, such as `user:password`, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur.

Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later.

## Affected versions

uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2.

## Credits

Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue.
Also thanks to nobu for additional fixes of this vulnerability.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27221.json
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27221.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-27221
reference_id
reference_type
scores
0
value 0.00038
scoring_system epss
scoring_elements 0.11384
published_at 2026-04-02T12:55:00Z
1
value 0.00038
scoring_system epss
scoring_elements 0.1144
published_at 2026-04-04T12:55:00Z
2
value 0.00118
scoring_system epss
scoring_elements 0.30715
published_at 2026-04-07T12:55:00Z
3
value 0.00137
scoring_system epss
scoring_elements 0.33581
published_at 2026-04-12T12:55:00Z
4
value 0.00137
scoring_system epss
scoring_elements 0.33568
published_at 2026-04-18T12:55:00Z
5
value 0.00137
scoring_system epss
scoring_elements 0.33592
published_at 2026-04-16T12:55:00Z
6
value 0.00137
scoring_system epss
scoring_elements 0.33558
published_at 2026-04-13T12:55:00Z
7
value 0.00152
scoring_system epss
scoring_elements 0.35907
published_at 2026-04-11T12:55:00Z
8
value 0.00166
scoring_system epss
scoring_elements 0.37695
published_at 2026-04-08T12:55:00Z
9
value 0.00166
scoring_system epss
scoring_elements 0.37709
published_at 2026-04-09T12:55:00Z
10
value 0.00169
scoring_system epss
scoring_elements 0.37626
published_at 2026-05-07T12:55:00Z
11
value 0.00169
scoring_system epss
scoring_elements 0.37556
published_at 2026-05-05T12:55:00Z
12
value 0.00173
scoring_system epss
scoring_elements 0.3847
published_at 2026-04-26T12:55:00Z
13
value 0.00173
scoring_system epss
scoring_elements 0.3838
published_at 2026-04-29T12:55:00Z
14
value 0.00173
scoring_system epss
scoring_elements 0.38495
published_at 2026-04-24T12:55:00Z
15
value 0.00173
scoring_system epss
scoring_elements 0.38651
published_at 2026-04-21T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-27221
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27221
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27221
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:38:46Z/
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml
5
reference_url https://github.com/ruby/uri
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri
6
reference_url https://github.com/ruby/uri/pull/154
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri/pull/154
7
reference_url https://github.com/ruby/uri/pull/155
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri/pull/155
8
reference_url https://github.com/ruby/uri/pull/156
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri/pull/156
9
reference_url https://github.com/ruby/uri/pull/157
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri/pull/157
10
reference_url https://hackerone.com/reports/2957667
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:38:46Z/
url https://hackerone.com/reports/2957667
11
reference_url https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html
12
reference_url https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html
13
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-27221
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-27221
14
reference_url https://www.cve.org/CVERecord?id=CVE-2025-27221
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements
1
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
2
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
3
value LOW
scoring_system generic_textual
scoring_elements
url https://www.cve.org/CVERecord?id=CVE-2025-27221
15
reference_url https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
16
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103794
reference_id 1103794
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103794
17
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2349700
reference_id 2349700
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2349700
18
reference_url https://github.com/advisories/GHSA-22h5-pq3x-2gf2
reference_id GHSA-22h5-pq3x-2gf2
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-22h5-pq3x-2gf2
19
reference_url https://access.redhat.com/errata/RHSA-2025:10217
reference_id RHSA-2025:10217
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:10217
20
reference_url https://access.redhat.com/errata/RHSA-2025:4063
reference_id RHSA-2025:4063
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4063
21
reference_url https://access.redhat.com/errata/RHSA-2025:4488
reference_id RHSA-2025:4488
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4488
22
reference_url https://access.redhat.com/errata/RHSA-2025:4493
reference_id RHSA-2025:4493
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4493
23
reference_url https://access.redhat.com/errata/RHSA-2025:8131
reference_id RHSA-2025:8131
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:8131
24
reference_url https://usn.ubuntu.com/7418-1/
reference_id USN-7418-1
reference_type
scores
url https://usn.ubuntu.com/7418-1/
25
reference_url https://usn.ubuntu.com/7442-1/
reference_id USN-7442-1
reference_type
scores
url https://usn.ubuntu.com/7442-1/
fixed_packages
0
url pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye
purl pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye
1
url pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u5?distro=bullseye
purl pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u5?distro=bullseye
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u5%3Fdistro=bullseye
aliases CVE-2025-27221, GHSA-22h5-pq3x-2gf2
risk_score 1.6
exploitability 0.5
weighted_severity 3.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-n1ja-n53g-fycm
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u5%3Fdistro=bullseye