Skip to content
OpenAdvisories
Low USN-8137-1 1 CVE

ruby2.3, ruby2.5, ruby2.7, ruby3.0, ruby3.2, ruby3.3 vulnerability

Published Mar 31, 2026 · Updated Oct 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the Ruby URI gem did not properly handle sensitive
information when combining URIs. A remote attacker could possibly use this
issue to leak authentication credentials.

Fixed packages 6

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS ruby3.0 3.0.2-7ubuntu2.12
Ubuntu · 24.04 LTS 24.04:LTS ruby3.2 3.2.3-1ubuntu0.24.04.7
Ubuntu · 25.10 ruby3.3 3.3.8-2ubuntu2.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ruby2.3 2.3.1-2~ubuntu16.04.16+esm12
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ruby2.5 2.5.1-1ubuntu1.16+esm7
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS ruby2.7 2.7.0-5ubuntu1.18+esm4

Vulnerabilities 1

  • Low 2.1
    CVE-2025-61594

    URI Credential Leakage Bypass over CVE-2025-27221

    URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to…

    ruby uri ruby2.3 ruby Debian Ubuntu Azure Linux Alpine Wolfi RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2025-61594