CVE-2025-61594: 
Ruby vulnerability analysis and mitigation

CVE-2025-61594 is a credential leakage vulnerability in the Ruby uri gem that bypasses the fix previously applied for CVE-2025-27221. When using the + operator to combine URIs, sensitive information such as passwords embedded in the original URI can be leaked to unintended recipients, violating RFC3986. The vulnerability was disclosed on October 7, 2025, and affects uri gem versions 0.12.4 and earlier (bundled with Ruby 3.2), 0.13.2 and earlier (bundled with Ruby 3.3), and 1.0.3 and earlier (bundled with Ruby 3.4). It carries a CVSS v3.1 base score of 7.5 (High) (Ruby Advisory, GitHub Advisory).

The root cause is classified under CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In the vulnerable merge method of URI::Generic, the authority check used rel.userinfo || rel.host || rel.port — meaning when a relative URI specifying only a host was merged with a base URI containing credentials, the base URI's password was incorrectly retained in the resulting merged URI. The fix introduces a new authority method that atomically returns all authority components (user, password, host, port) and a set_authority setter that replaces them together, ensuring credentials from the base URI are not carried over when the relative URI defines its own authority. Additionally, setting host= or port= now explicitly clears userinfo to prevent credential leakage through component mutation (GitHub Commit v0-12, GitHub Commit v0-13, GitHub Commit HEAD).

Successful exploitation results in a confidentiality breach where authentication credentials (passwords) embedded in URIs are exposed to unintended parties. Applications that use the + operator or merge method to combine URIs — particularly those constructing URIs dynamically from user-supplied or external input — may inadvertently transmit credentials to third-party servers or log them in accessible locations. There is no integrity or availability impact; the scope is limited to credential exposure, but leaked credentials could enable unauthorized access to protected resources or facilitate further attacks (GitHub Advisory, Ruby Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.045%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

Update the uri gem to the following patched versions based on your Ruby series: 0.12.5 or later (Ruby 3.2), 0.13.3 or later (Ruby 3.3), or 1.0.4 or later (Ruby 3.4). Patched gems are available on RubyGems.org. As a code-level workaround, review all application code that uses the + operator or URI#merge with URIs containing embedded credentials, and refactor to avoid combining credential-bearing URIs with relative URIs that specify a different authority. Audit application logs and error messages for inadvertent credential exposure resulting from URI operations (Ruby Advisory, Ruby Advisory DB).

The Ruby security team published an advisory on October 7, 2025, crediting junfuchong (chongfujun) for discovering the bypass and nobu for additional fixes (Ruby Advisory). Oracle included the CVE in its October 2025 security bulletin, and downstream vendors including Red Hat, IBM, Microsoft (Azure Linux), Fedora, AlmaLinux, and Ubuntu have issued their own advisories and package updates (Oracle Advisory, IBM Advisory). Puppet also released Core 8.16.0 incorporating the fix. Community discussion was limited, with no significant controversy or widespread alarm given the absence of known active exploitation.