Skip to content
OpenAdvisories

Product · ruby-lang

URI

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.2
    CVE-2025-27221

    URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+

    In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

    ruby-lang URI ruby2.3 ruby2.5 Debian Ubuntu RubyGems