VulnerableCode Package Details - pkg:gem/uri@0.10.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-qfe5-w7ge-skfa Aliases: CVE-2023-28755 GHSA-hv5j-3h9f-99c2	A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.	0.10.0.1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 0.10.2 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 0.11.1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 0.12.1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-ug6n-hxax-xfgp Aliases: CVE-2025-27221 GHSA-22h5-pq3x-2gf2	URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+ There is a possibility for userinfo leakage by in the uri gem. This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem. ## Details The methods `URI#join`, `URI#merge`, and `URI#+` retained userinfo, such as `user:password`, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur. Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later. ## Affected versions uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2. ## Credits Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue. Also thanks to nobu for additional fixes of this vulnerability.	0.11.3 Affected by 0 other vulnerabilities. 0.12.4 Affected by 0 other vulnerabilities. 0.13.2 Affected by 0 other vulnerabilities. 1.0.3 Affected by 0 other vulnerabilities.
VCID-xwax-7pq7-pbcy Aliases: CVE-2023-36617 GHSA-hww2-5g85-429m	A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.	0.10.0.3 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 0.10.3 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 0.11.2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 0.12.2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-qfe5-w7ge-skfa
Aliases:
CVE-2023-28755
GHSA-hv5j-3h9f-99c2

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.

0.10.0.1
Affected by 2 other vulnerabilities.

0.10.2
Affected by 2 other vulnerabilities.

0.11.1
Affected by 2 other vulnerabilities.

0.12.1
Affected by 2 other vulnerabilities.

VCID-ug6n-hxax-xfgp
Aliases:
CVE-2025-27221
GHSA-22h5-pq3x-2gf2

URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+ There is a possibility for userinfo leakage by in the uri gem. This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem. ## Details The methods `URI#join`, `URI#merge`, and `URI#+` retained userinfo, such as `user:password`, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur. Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later. ## Affected versions uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2. ## Credits Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue. Also thanks to nobu for additional fixes of this vulnerability.

0.11.3
Affected by 0 other vulnerabilities.

0.12.4
Affected by 0 other vulnerabilities.

0.13.2
Affected by 0 other vulnerabilities.

1.0.3
Affected by 0 other vulnerabilities.

VCID-xwax-7pq7-pbcy
Aliases:
CVE-2023-36617
GHSA-hww2-5g85-429m

A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version.

0.10.0.3
Affected by 1 other vulnerability.

0.10.3
Affected by 1 other vulnerability.

0.11.2
Affected by 1 other vulnerability.

0.12.2
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-03T19:22:10.673384+00:00	GitLab Importer	Affected by	VCID-ug6n-hxax-xfgp	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/uri/CVE-2025-27221.yml	37.0.0
2025-07-03T18:46:14.296029+00:00	GitLab Importer	Affected by	VCID-xwax-7pq7-pbcy	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/uri/CVE-2023-36617.yml	37.0.0
2025-07-03T18:41:43.459213+00:00	GitLab Importer	Affected by	VCID-qfe5-w7ge-skfa	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/uri/CVE-2023-28755.yml	37.0.0
2025-07-03T17:44:43.086452+00:00	GHSA Importer	Affected by	VCID-qfe5-w7ge-skfa	https://github.com/advisories/GHSA-hv5j-3h9f-99c2	37.0.0