Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2025-27221

LOW
Published 2025-03-03T00:00:00.000Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2025-27221. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
3.2
/10
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.000
probability
of exploitation in the wild

There is a 0.0% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.023
Higher than 2.3% of all CVEs

Attack Vector Metrics

Attack Vector
Not Available
Attack Complexity
Not Available
Privileges Required
Not Available
User Interaction
Not Available
Scope
Not Available

Impact Metrics

Confidentiality
Not Available
Integrity
Not Available
Availability
Not Available

Description

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

Available Exploits

No exploits available for this CVE.

Related News

Ruby 3.2.8 Released

Ruby 3.2.8 has been released. This release includes CVE-2025-27219, CVE-2025-27220 and CVE-2025-27221 fixes. Please see the GitHub releases for further details. This version is a last version of normal maintenance for Ruby 3.2 series. We will fix only secur…

Ruby-lang.org 2025-03-26 04:45
Read More
Ruby 3.1.7 Released

Ruby 3.1.7 has been released. This release includes CVE-2025-27219, CVE-2025-27220 and CVE-2025-27221 fixes and update bundled REXML and RSS gems. Please see the GitHub releases for further details. This version is a final release of Ruby 3.1 series. We wil…

Ruby-lang.org 2025-03-26 04:44
Read More

Affected Products

ruby-lang

URI

Affected Versions:

0 0.12.0 0.13.0 1.0.0

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed LOW

URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+

GHSA-22h5-pq3x-2gf2

Advisory Details

There is a possibility for userinfo leakage by in the uri gem. This vulnerability has been assigned the CVE identifier CVE-2025-27221. We recommend upgrading the uri gem. ## Details The methods `URI#join`, `URI#merge`, and `URI#+` retained userinfo, such as `user:password`, even after the host is replaced. When generating a URL to a malicious host from a URL containing secret userinfo using these methods, and having someone access that URL, an unintended userinfo leak could occur. Please update URI gem to version 0.11.3, 0.12.4, 0.13.2, 1.0.3 or later. ## Affected versions uri gem versions < 0.11.3, 0.12.0 to 0.12.3, 0.13.0, 0.13.1 and 1.0.0 to 1.0.2. ## Credits Thanks to Tsubasa Irisawa (lambdasawa) for discovering this issue. Also thanks to nobu for additional fixes of this vulnerability.

Affected Packages

RubyGems uri
ECOSYSTEM: ≥0 <0.11.3
RubyGems uri
ECOSYSTEM: ≥0.12.0 <0.12.4
RubyGems uri
ECOSYSTEM: ≥0.13.0 <0.13.2
RubyGems uri
ECOSYSTEM: ≥1.0.0 <1.0.3

CVSS Scoring

CVSS Score

2.5

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-27221
WEB https://github.com/ruby/uri/pull/154
WEB https://github.com/ruby/uri/pull/155
WEB https://github.com/ruby/uri/pull/156
WEB https://github.com/ruby/uri/pull/157
WEB https://hackerone.com/reports/2957667
PACKAGE https://github.com/ruby/uri
WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml
WEB https://www.cve.org/CVERecord?id=CVE-2025-27221
WEB https://www.ruby-lang.org/en/news/2025/02/26/security-advisories

Advisory provided by GitHub Security Advisory Database. Published: March 3, 2025, Modified: March 4, 2025

Social Media Intelligence

Real-time discussions and threat intelligence from social platforms

1 post
Reddit • 6 days, 17 hours ago
michaelpaoli

Debian 13.1 (and 12.12) 2025-09-06 "Just" a "minor" point release. But for those that have been waiting to upgrade to Debian 13, perhaps that time now draws nearer? [\[SUA 273-1\] Upcoming Debian 13 Update (13.1)](https://lists.debian.org/debian-stable-announce/2025/09/msg00000.html) [\[SUA 274-1\] Upcoming Debian 12 Update (12.12)](https://lists.debian.org/debian-stable-announce/2025/09/msg00001.html) 13.1: >\[SUA 273-1\] Upcoming Debian 13 Update (13.1) …

Also mentions: CVE-2025-7039 CVE-2025-40927 CVE-2025-9185 CVE-2025-9181 CVE-2025-47806 CVE-2025-47219 CVE-2025-47807 CVE-2025-47808 CVE-2025-53859 CVE-2025-50952 CVE-2025-54798 CVE-2025-54874 CVE-2025-54350 CVE-2025-54349 CVE-2025-27613 CVE-2025-27614 CVE-2025-20260 CVE-2025-23048 CVE-2025-46835 CVE-2025-49812 CVE-2025-49630 CVE-2025-53019 CVE-2025-53101 CVE-2025-53020 CVE-2025-8058 CVE-2024-42516 CVE-2024-43394 CVE-2024-43204 CVE-2024-47252 CVE-2025-6965 CVE-2025-7394 CVE-2025-7783 CVE-2025-53015 CVE-2025-53014 CVE-2025-48385 CVE-2025-48384 CVE-2024-25178 CVE-2024-25177 CVE-2024-25176 CVE-2025-4748 CVE-2024-6174 CVE-2024-11584 CVE-2025-6170 CVE-2025-49794 CVE-2025-49796 CVE-2025-6021 CVE-2025-5916 CVE-2025-5915 CVE-2025-5914 CVE-2025-5917 CVE-2025-49133 CVE-2025-48387 CVE-2025-27553 CVE-2025-27773 CVE-2025-48734 CVE-2025-46712 CVE-2025-46393 CVE-2025-46398 CVE-2025-46397 CVE-2025-47203 CVE-2023-52970 CVE-2023-26819 CVE-2025-40908 CVE-2025-40909 CVE-2025-4373 CVE-2023-53154 CVE-2025-2784 CVE-2025-48060 CVE-2025-47273 CVE-2025-4802 CVE-2025-46399 CVE-2025-46400 CVE-2025-46337 CVE-2025-32050 CVE-2025-46421 CVE-2025-46420 CVE-2025-43965 CVE-2025-43964 CVE-2025-43963 CVE-2025-43962 CVE-2025-43961 CVE-2025-3818 CVE-2025-32906 CVE-2025-32912 CVE-2025-32911 CVE-2025-30722 CVE-2025-30693 CVE-2025-3576 CVE-2025-32910 CVE-2025-32909 CVE-2025-32913 CVE-2025-32053 CVE-2025-32052 CVE-2025-32051 CVE-2024-12905 CVE-2025-30472 CVE-2024-6866 CVE-2024-6844 CVE-2024-6839 CVE-2024-8176 CVE-2023-52971 CVE-2023-52969 CVE-2025-27516 CVE-2022-37660 CVE-2024-56161 CVE-2025-20128 CVE-2025-23016 CVE-2024-34703 CVE-2024-34702 CVE-2024-45236 CVE-2024-45234 CVE-2024-45235 CVE-2024-45238 CVE-2024-45237 CVE-2024-45239 CVE-2024-0962 CVE-2024-10525 CVE-2024-31031 CVE-2024-38875 CVE-2024-57822 CVE-2024-57823 CVE-2024-3935 CVE-2024-42005 CVE-2024-39330 CVE-2024-39329 CVE-2024-39917 CVE-2024-39312 CVE-2024-39614 CVE-2024-52532 CVE-2024-52530 CVE-2024-52531 CVE-2024-33899 CVE-2024-50602 CVE-2024-50624 CVE-2024-50383 CVE-2024-50612 CVE-2024-5569 CVE-2024-49768 CVE-2024-49769 CVE-2024-1681 CVE-2024-41991 CVE-2024-41990 CVE-2024-41989 CVE-2024-8376 CVE-2023-36053 CVE-2023-31484 CVE-2023-28755 CVE-2023-28366 CVE-2023-42822 CVE-2023-52425 CVE-2023-40184 CVE-2022-33065 CVE-2021-46312 CVE-2021-46310 CVE-2021-25743 CVE-2019-25211
70
8
86.0
View Original

References

https://hackerone.com/reports/2957667
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml
Published: 2025-03-03T00:00:00.000Z
Last Modified: 2025-03-04T16:39:00.368Z
Copied to clipboard!