Skip to content

Add advisory for CVE-2025-61594 (URI Credential Leakage Bypass) for Ruby < 3.3.10 and < 3.4.7 #913

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Nov 4, 2025
Merged

Add advisory for CVE-2025-61594 (URI Credential Leakage Bypass) for Ruby < 3.3.10 and < 3.4.7 #913

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
05e861e
Add advisory for CVE-2025-61594 (URI Credential Leakage Bypass) for R…
hudakh Oct 27, 2025
cb8543d
Add related url
hudakh Oct 28, 2025
7274e73
include all older rubies in affected_versions
hudakh Oct 28, 2025
55028c1
Remove `affected_versions`
huda-kh Oct 29, 2025
b172065
Add more related references
huda-kh Oct 29, 2025
7f8092c
Add missing newline at end of file
huda-kh Nov 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions rubies/ruby/CVE-2025-61594.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
---
engine: ruby
cve: 2025-61594
url: https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594/
title: URI Credential Leakage Bypass
date: 2025-10-07
description: |
A vulnerability in the URI library bundled with Ruby allows sensitive user credentials
(such as usernames or passwords) in a URI to be unintentionally leaked when combining
URIs using the `+` operator. This issue bypasses the previous fix for CVE-2025-27221.

The issue affects Ruby's built-in URI implementation prior to Ruby 3.3.10 and 3.4.7.
patched_versions:
- "~> 3.3.10"
- ">= 3.4.7"
related:
url:
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml
- https://www.cve.org/CVERecord?id=CVE-2025-61594
- https://www.ruby-lang.org/en/news/2025/10/23/ruby-3-3-10-released/
- https://www.ruby-lang.org/en/news/2025/10/07/ruby-3-4-7-released/