We published security advisory for CVE-2025-61594.

## CVE-2025-61594: URI Credential Leakage Bypass over CVE-2025-27221

In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.

This vulnerability has been assigned the CVE identifier [CVE-2025-61594](https://www.cve.org/CVERecord?id=CVE-2025-61594). We recommend upgrading the uri gem.

### Details

When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.

Please update URI gem to version 0.12.5, 0.13.3, 1.0.4 or later.

### Affected versions

* uri gem versions < 0.12.5, 0.13.0 to 0.13.2 and 1.0.0 to 1.0.3.

### Credits

Thanks to [junfuchong (chongfujun)](https://hackerone.com/chongfujun) for discovering this issue. Also thanks to [nobu](https://github.com/nobu) for additional fixes of this vulnerability.

## History

* Originally published at 2025-10-07 0:00:00 (UTC)