# CVE-2025-61594: URI Credential Leakage Bypass over

Source: https://junglewise.ai/threats/cve-2025-61594-uri-credential-leakage-bypass-over  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-30. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2025-61594 · Severity: high · CVSS 7.5 · Published 2025-12-30

### Impact

In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.

When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.

The vulnerability affects the `uri` gem bundled with the following Ruby series:

* 0.12.4 and earlier (bundled in Ruby 3.2 series)
* 0.13.2 and earlier (bundled in Ruby 3.3 series)
* 1.0.3 and earlier (bundled in Ruby 3.4 series)

### Patches

Upgrade to 0.12.5, 0.13.3 or 1.0.4

### References

* https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/
* https://hackerone.com/reports/2957667

Technologies: [uri (RubyGems)](https://junglewise.ai/threats/technologies/uri). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2025-61594 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61594 being exploited in the wild.

**How severe is CVE-2025-61594?** High severity, with a CVSS score of 7.5, published 30 December 2025.

**Which products and versions are affected?** uri (RubyGems) ECOSYSTEM:introduced=0,fixed=0.12.5.

**Is there a fix for CVE-2025-61594?** Yes. uri (RubyGems): upgrade to 0.12.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-61594?** Check whether you run uri (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- uri (RubyGems): upgrade to 0.12.5 or later

  ```sh
  bundle update uri
  ```


## Affected products

- uri (RubyGems) ECOSYSTEM:introduced=0,fixed=0.12.5

## Identifiers

- CVE-2025-61594
- GHSA-j4pr-3wm6-xx2r

## References

- [https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902](https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902)
- [https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c](https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c)
- [https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a](https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a)
- [https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml](https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml)
- [https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594](https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594)
- [https://github.com/ruby/uri/security/advisories/GHSA-j4pr-3wm6-xx2r](https://github.com/ruby/uri/security/advisories/GHSA-j4pr-3wm6-xx2r)

## Related threats

- [URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+](https://junglewise.ai/threats/cve-2025-27221-uri-allows-for-userinfo-leakage-in-uri-join-uri-merge-and-uri)
- [URI gem has ReDoS vulnerability](https://junglewise.ai/threats/cve-2023-36617-uri-gem-has-redos-vulnerability)
- [Ruby URI component ReDoS issue](https://junglewise.ai/threats/cve-2023-28755-ruby-uri-component-redos-issue)