Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-n1ja-n53g-fycm
Summary
URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+
There is a possibility for userinfo leakage by in the uri gem.
This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem.

## Details

The methods `URI#join`, `URI#merge`, and `URI#+` retained userinfo, such as `user:password`, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur.

Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later.

## Affected versions

uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2.

## Credits

Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue.
Also thanks to nobu for additional fixes of this vulnerability.
Aliases
0
alias CVE-2025-27221
1
alias GHSA-22h5-pq3x-2gf2
Fixed_packages
0
url pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye
purl pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1?distro=bullseye
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1%3Fdistro=bullseye
1
url pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u5?distro=bullseye
purl pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u5?distro=bullseye
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u5%3Fdistro=bullseye
2
url pkg:deb/debian/ruby3.3@3.3.8-2.1?distro=trixie
purl pkg:deb/debian/ruby3.3@3.3.8-2.1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby3.3@3.3.8-2.1%3Fdistro=trixie
3
url pkg:deb/debian/ruby3.3@3.3.7-2?distro=trixie
purl pkg:deb/debian/ruby3.3@3.3.7-2?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby3.3@3.3.7-2%3Fdistro=trixie
4
url pkg:deb/debian/ruby3.3@3.3.8-2?distro=trixie
purl pkg:deb/debian/ruby3.3@3.3.8-2?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby3.3@3.3.8-2%3Fdistro=trixie
5
url pkg:deb/debian/rubygems@3.2.5-2?distro=trixie
purl pkg:deb/debian/rubygems@3.2.5-2?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dy2a-n93k-yfgd
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/rubygems@3.2.5-2%3Fdistro=trixie
6
url pkg:deb/debian/rubygems@3.2.5-2%2Bdeb11u1?distro=trixie
purl pkg:deb/debian/rubygems@3.2.5-2%2Bdeb11u1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/rubygems@3.2.5-2%252Bdeb11u1%3Fdistro=trixie
7
url pkg:deb/debian/rubygems@3.3.15-2%2Bdeb12u1
purl pkg:deb/debian/rubygems@3.3.15-2%2Bdeb12u1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/rubygems@3.3.15-2%252Bdeb12u1
8
url pkg:deb/debian/rubygems@3.3.15-2%2Bdeb12u1?distro=trixie
purl pkg:deb/debian/rubygems@3.3.15-2%2Bdeb12u1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/rubygems@3.3.15-2%252Bdeb12u1%3Fdistro=trixie
9
url pkg:deb/debian/rubygems@3.6.6-1?distro=trixie
purl pkg:deb/debian/rubygems@3.6.6-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/rubygems@3.6.6-1%3Fdistro=trixie
10
url pkg:deb/debian/rubygems@3.6.7-2?distro=trixie
purl pkg:deb/debian/rubygems@3.6.7-2?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/rubygems@3.6.7-2%3Fdistro=trixie
11
url pkg:gem/uri@0.11.3
purl pkg:gem/uri@0.11.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.11.3
12
url pkg:gem/uri@0.12.4
purl pkg:gem/uri@0.12.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.12.4
13
url pkg:gem/uri@0.13.2
purl pkg:gem/uri@0.13.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.13.2
14
url pkg:gem/uri@1.0.3
purl pkg:gem/uri@1.0.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@1.0.3
Affected_packages
0
url pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1
purl pkg:deb/debian/ruby2.7@2.7.4-1%2Bdeb11u1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2sv2-6snv-2bd3
1
vulnerability VCID-5mfh-yzfk-cqaa
2
vulnerability VCID-9g2w-sc9w-eyce
3
vulnerability VCID-9x9w-2k98-wydm
4
vulnerability VCID-ajtx-8w3u-rkae
5
vulnerability VCID-c5xq-bv4t-73ff
6
vulnerability VCID-exq5-cnrm-3uhd
7
vulnerability VCID-h4mf-99f4-9bdw
8
vulnerability VCID-jdtw-bn8z-e3b6
9
vulnerability VCID-m4a8-ya4v-tkgm
10
vulnerability VCID-m6hy-vnf9-hyfe
11
vulnerability VCID-msc8-xjz2-2kb4
12
vulnerability VCID-n1ja-n53g-fycm
13
vulnerability VCID-qu1w-yd76-t7c1
14
vulnerability VCID-uxdx-abx7-fkdy
15
vulnerability VCID-x126-x9qm-e7d3
16
vulnerability VCID-yj1t-rga1-x3ev
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/ruby2.7@2.7.4-1%252Bdeb11u1
1
url pkg:deb/debian/rubygems@1.8.24-1
purl pkg:deb/debian/rubygems@1.8.24-1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-8d7n-bfhu-dkfd
1
vulnerability VCID-8hm4-c4w4-gfen
2
vulnerability VCID-9t45-d5mf-3uar
3
vulnerability VCID-af1f-xwwy-jfa8
4
vulnerability VCID-b36p-re17-n7dq
5
vulnerability VCID-cde2-rv4n-tkau
6
vulnerability VCID-f7x5-hz5f-hyd3
7
vulnerability VCID-ha3g-uyse-wybx
8
vulnerability VCID-jkwe-c323-3yez
9
vulnerability VCID-jmzh-89dm-r7g2
10
vulnerability VCID-k2ga-fgvp-5qc7
11
vulnerability VCID-ky5r-bch5-m7dv
12
vulnerability VCID-mamm-cvdr-subf
13
vulnerability VCID-n1ja-n53g-fycm
14
vulnerability VCID-t78a-dw4s-vqf5
15
vulnerability VCID-tq93-h2ag-s3bx
16
vulnerability VCID-ucdh-7fgy-33h8
17
vulnerability VCID-uxdx-abx7-fkdy
18
vulnerability VCID-w4ns-f42m-pyec
19
vulnerability VCID-xbrw-47yv-wqcr
20
vulnerability VCID-xgmc-a5rk-zqag
21
vulnerability VCID-xgsa-5umz-qffr
22
vulnerability VCID-xz68-vwz2-2ke4
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/rubygems@1.8.24-1
2
url pkg:deb/debian/rubygems@3.2.5-2
purl pkg:deb/debian/rubygems@3.2.5-2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-dy2a-n93k-yfgd
1
vulnerability VCID-n1ja-n53g-fycm
2
vulnerability VCID-uxdx-abx7-fkdy
3
vulnerability VCID-xbrw-47yv-wqcr
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/rubygems@3.2.5-2
3
url pkg:gem/uri@0.10.0
purl pkg:gem/uri@0.10.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ajtx-8w3u-rkae
1
vulnerability VCID-n1ja-n53g-fycm
2
vulnerability VCID-nw8a-e25n-mbgs
3
vulnerability VCID-uxdx-abx7-fkdy
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.10.0
4
url pkg:gem/uri@0.10.0.1
purl pkg:gem/uri@0.10.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ajtx-8w3u-rkae
1
vulnerability VCID-n1ja-n53g-fycm
2
vulnerability VCID-nw8a-e25n-mbgs
3
vulnerability VCID-uxdx-abx7-fkdy
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.10.0.1
5
url pkg:gem/uri@0.10.0.2
purl pkg:gem/uri@0.10.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ajtx-8w3u-rkae
1
vulnerability VCID-n1ja-n53g-fycm
2
vulnerability VCID-nw8a-e25n-mbgs
3
vulnerability VCID-uxdx-abx7-fkdy
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.10.0.2
6
url pkg:gem/uri@0.10.0.3
purl pkg:gem/uri@0.10.0.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-n1ja-n53g-fycm
1
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.10.0.3
7
url pkg:gem/uri@0.10.1
purl pkg:gem/uri@0.10.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ajtx-8w3u-rkae
1
vulnerability VCID-n1ja-n53g-fycm
2
vulnerability VCID-nw8a-e25n-mbgs
3
vulnerability VCID-uxdx-abx7-fkdy
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.10.1
8
url pkg:gem/uri@0.10.2
purl pkg:gem/uri@0.10.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ajtx-8w3u-rkae
1
vulnerability VCID-n1ja-n53g-fycm
2
vulnerability VCID-nw8a-e25n-mbgs
3
vulnerability VCID-uxdx-abx7-fkdy
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.10.2
9
url pkg:gem/uri@0.10.3
purl pkg:gem/uri@0.10.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-n1ja-n53g-fycm
1
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.10.3
10
url pkg:gem/uri@0.11.0
purl pkg:gem/uri@0.11.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ajtx-8w3u-rkae
1
vulnerability VCID-n1ja-n53g-fycm
2
vulnerability VCID-nw8a-e25n-mbgs
3
vulnerability VCID-uxdx-abx7-fkdy
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.11.0
11
url pkg:gem/uri@0.11.1
purl pkg:gem/uri@0.11.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ajtx-8w3u-rkae
1
vulnerability VCID-n1ja-n53g-fycm
2
vulnerability VCID-nw8a-e25n-mbgs
3
vulnerability VCID-uxdx-abx7-fkdy
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.11.1
12
url pkg:gem/uri@0.11.2
purl pkg:gem/uri@0.11.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-n1ja-n53g-fycm
1
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.11.2
13
url pkg:gem/uri@0.12
purl pkg:gem/uri@0.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ajtx-8w3u-rkae
1
vulnerability VCID-n1ja-n53g-fycm
2
vulnerability VCID-uxdx-abx7-fkdy
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.12
14
url pkg:gem/uri@0.12.0
purl pkg:gem/uri@0.12.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ajtx-8w3u-rkae
1
vulnerability VCID-n1ja-n53g-fycm
2
vulnerability VCID-nw8a-e25n-mbgs
3
vulnerability VCID-uxdx-abx7-fkdy
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.12.0
15
url pkg:gem/uri@0.12.1
purl pkg:gem/uri@0.12.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ajtx-8w3u-rkae
1
vulnerability VCID-n1ja-n53g-fycm
2
vulnerability VCID-nw8a-e25n-mbgs
3
vulnerability VCID-uxdx-abx7-fkdy
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.12.1
16
url pkg:gem/uri@0.12.2
purl pkg:gem/uri@0.12.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-n1ja-n53g-fycm
1
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.12.2
17
url pkg:gem/uri@0.12.3
purl pkg:gem/uri@0.12.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-n1ja-n53g-fycm
1
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.12.3
18
url pkg:gem/uri@0.13
purl pkg:gem/uri@0.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-n1ja-n53g-fycm
1
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.13
19
url pkg:gem/uri@0.13.0
purl pkg:gem/uri@0.13.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-n1ja-n53g-fycm
1
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.13.0
20
url pkg:gem/uri@0.13.1
purl pkg:gem/uri@0.13.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-n1ja-n53g-fycm
1
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.13.1
21
url pkg:gem/uri@0.14
purl pkg:gem/uri@0.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-n1ja-n53g-fycm
1
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@0.14
22
url pkg:gem/uri@1.0.0
purl pkg:gem/uri@1.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-n1ja-n53g-fycm
1
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@1.0.0
23
url pkg:gem/uri@1.0.1
purl pkg:gem/uri@1.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-n1ja-n53g-fycm
1
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@1.0.1
24
url pkg:gem/uri@1.0.2
purl pkg:gem/uri@1.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-n1ja-n53g-fycm
1
vulnerability VCID-nw8a-e25n-mbgs
resource_url http://public2.vulnerablecode.io/packages/pkg:gem/uri@1.0.2
25
url pkg:rpm/redhat/ruby@3.3.8-10?arch=el10_0
purl pkg:rpm/redhat/ruby@3.3.8-10?arch=el10_0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-exq5-cnrm-3uhd
1
vulnerability VCID-n1ja-n53g-fycm
2
vulnerability VCID-wyjh-cuuy-zbeb
resource_url http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/ruby@3.3.8-10%3Farch=el10_0
References
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27221.json
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-27221.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-27221
reference_id
reference_type
scores
0
value 0.00038
scoring_system epss
scoring_elements 0.11384
published_at 2026-04-02T12:55:00Z
1
value 0.00038
scoring_system epss
scoring_elements 0.1144
published_at 2026-04-04T12:55:00Z
2
value 0.00118
scoring_system epss
scoring_elements 0.30715
published_at 2026-04-07T12:55:00Z
3
value 0.00137
scoring_system epss
scoring_elements 0.33558
published_at 2026-04-13T12:55:00Z
4
value 0.00137
scoring_system epss
scoring_elements 0.33568
published_at 2026-04-18T12:55:00Z
5
value 0.00137
scoring_system epss
scoring_elements 0.33592
published_at 2026-04-16T12:55:00Z
6
value 0.00137
scoring_system epss
scoring_elements 0.33581
published_at 2026-04-12T12:55:00Z
7
value 0.00152
scoring_system epss
scoring_elements 0.35907
published_at 2026-04-11T12:55:00Z
8
value 0.00166
scoring_system epss
scoring_elements 0.37695
published_at 2026-04-08T12:55:00Z
9
value 0.00166
scoring_system epss
scoring_elements 0.37709
published_at 2026-04-09T12:55:00Z
10
value 0.00169
scoring_system epss
scoring_elements 0.37643
published_at 2026-05-09T12:55:00Z
11
value 0.00169
scoring_system epss
scoring_elements 0.37556
published_at 2026-05-11T12:55:00Z
12
value 0.00169
scoring_system epss
scoring_elements 0.37626
published_at 2026-05-07T12:55:00Z
13
value 0.00169
scoring_system epss
scoring_elements 0.37607
published_at 2026-05-14T12:55:00Z
14
value 0.00169
scoring_system epss
scoring_elements 0.3753
published_at 2026-05-12T12:55:00Z
15
value 0.00173
scoring_system epss
scoring_elements 0.3838
published_at 2026-04-29T12:55:00Z
16
value 0.00173
scoring_system epss
scoring_elements 0.38651
published_at 2026-04-21T12:55:00Z
17
value 0.00173
scoring_system epss
scoring_elements 0.38495
published_at 2026-04-24T12:55:00Z
18
value 0.00173
scoring_system epss
scoring_elements 0.3847
published_at 2026-04-26T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-27221
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27221
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27221
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:38:46Z/
url https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml
5
reference_url https://github.com/ruby/uri
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri
6
reference_url https://github.com/ruby/uri/pull/154
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri/pull/154
7
reference_url https://github.com/ruby/uri/pull/155
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri/pull/155
8
reference_url https://github.com/ruby/uri/pull/156
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri/pull/156
9
reference_url https://github.com/ruby/uri/pull/157
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/ruby/uri/pull/157
10
reference_url https://hackerone.com/reports/2957667
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-04T16:38:46Z/
url https://hackerone.com/reports/2957667
11
reference_url https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html
12
reference_url https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html
13
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-27221
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-27221
14
reference_url https://www.cve.org/CVERecord?id=CVE-2025-27221
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements
1
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
2
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
3
value LOW
scoring_system generic_textual
scoring_elements
url https://www.cve.org/CVERecord?id=CVE-2025-27221
15
reference_url https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
reference_id
reference_type
scores
0
value 3.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://www.ruby-lang.org/en/news/2025/02/26/security-advisories
16
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103794
reference_id 1103794
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103794
17
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2349700
reference_id 2349700
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2349700
18
reference_url https://github.com/advisories/GHSA-22h5-pq3x-2gf2
reference_id GHSA-22h5-pq3x-2gf2
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-22h5-pq3x-2gf2
19
reference_url https://access.redhat.com/errata/RHSA-2025:10217
reference_id RHSA-2025:10217
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:10217
20
reference_url https://access.redhat.com/errata/RHSA-2025:4063
reference_id RHSA-2025:4063
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4063
21
reference_url https://access.redhat.com/errata/RHSA-2025:4488
reference_id RHSA-2025:4488
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4488
22
reference_url https://access.redhat.com/errata/RHSA-2025:4493
reference_id RHSA-2025:4493
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:4493
23
reference_url https://access.redhat.com/errata/RHSA-2025:8131
reference_id RHSA-2025:8131
reference_type
scores
url https://access.redhat.com/errata/RHSA-2025:8131
24
reference_url https://usn.ubuntu.com/7418-1/
reference_id USN-7418-1
reference_type
scores
url https://usn.ubuntu.com/7418-1/
25
reference_url https://usn.ubuntu.com/7442-1/
reference_id USN-7442-1
reference_type
scores
url https://usn.ubuntu.com/7442-1/
Weaknesses
0
cwe_id 200
name Exposure of Sensitive Information to an Unauthorized Actor
description The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
1
cwe_id 212
name Improper Removal of Sensitive Information Before Storage or Transfer
description The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
3
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score0.1 - 5.3
Exploitability0.5
Weighted_severity3.2
Risk_score1.6
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-n1ja-n53g-fycm