URI Module Vulnerability Exposing User Credentials in Ruby
CVE-2025-61594
What is CVE-2025-61594?
The URI module in Ruby allows for managed handling of Uniform Resource Identifiers but contains a significant flaw in versions before 0.12.5, 0.13.3, and 1.0.4. This vulnerability enables a bypass of previous security measures designed to mitigate credential exposure. Specifically, using the '+' operator to concatenate URIs can inadvertently leak sensitive information, such as passwords. This behavior contravenes the standards outlined in RFC3986, jeopardizing the security of applications relying on affected versions of the URI module. Developers are urged to update to the fixed versions to ensure their applications are secure against this vulnerability.
Affected Version(s)
uri < 0.12.5 < 0.12.5
uri >= 0.13.0, < 0.13.3 < 0.13.0, 0.13.3
uri >= 1.0.0, < 1.0.4 < 1.0.0, 1.0.4