Skip to content
OpenAdvisories

Package · RubyGems

uri

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Low 2.1
    CVE-2025-61594

    URI Credential Leakage Bypass over CVE-2025-27221

    URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to…

    ruby uri ruby2.3 ruby Debian Ubuntu Azure Linux Alpine Wolfi RubyGems
  • Low 3.2
    CVE-2025-27221

    URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+

    In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

    ruby-lang URI kube-fluentd-operator ruby2.3 Debian Ubuntu Azure Linux Wolfi RubyGems
  • Medium 5.3
    CVE-2023-36617

    URI gem has ReDoS vulnerability

    A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser…

    kube-fluentd-operator ruby2.3 ruby2.5 jruby Debian Ubuntu Azure Linux Wolfi RubyGems
  • Medium 5.3
    CVE-2023-28755

    Ruby URI component ReDoS issue

    A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.…

    ruby2.3 ruby ruby2.5 jruby Debian Ubuntu Alpine Wolfi RubyGems