5.3

CVE-2025-27221: ruby-lang uri

CVSS: 5.3v3.1MediumModified
AliasesUBUNTU-CVE-2025-27221DEBIAN-CVE-2025-27221CGA-23q6-fj9g-4hf9
Published 03-03-2025Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2025-27221 is a medium (CVSS 5.3) vulnerability in ruby-lang uri. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.4% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (NVD)
EPSS score
0.51%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 17
DLA-4082-1DLA-4163-1MGASA-2025-0290RHSA-2025:10217RHSA-2025:4063RHSA-2025:4488

Timeline

  1. 03-03-2025
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.

CVSS metrics

8 scores · 7 sources · 2 versions

EPSS trend

Probability

0.51%

Chance of exploitation in the next 30 days

Percentile

42%

Versus all other CVEs

30-day change

+0.01 pp

From 0.50% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.51%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard47 products
  • elasticsearch-8.17< 8.17.10-r13
  • jruby-9.4< 9.4.14.0-r0
  • jruby-9.4-default-ruby< 9.4.14.0-r0
  • kube-fluentd-operator< 1.18.2-r33
  • kube-fluentd-operator-compat< 1.18.2-r33
Wolfi20 products
  • jruby-9.4< 9.4.14.0-r0
  • jruby-9.4-default-ruby< 9.4.14.0-r0
  • kube-fluentd-operator< 1.18.2-r33
  • kube-fluentd-operator-compat< 1.18.2-r33
  • kube-fluentd-operator-default-config< 1.18.2-r33
Ubuntu7 products
  • jrubyAll versions (No fix recorded)
  • ruby2.3< 2.3.1-2~ubuntu16.04.16+esm10
  • ruby2.5< 2.5.1-1ubuntu1.16+esm4
  • ruby2.7< 2.7.0-5ubuntu1.18
  • ruby3.0< 3.0.2-7ubuntu2.10
Debian3 products
  • ruby3.1All versions (No fix recorded)
  • ruby3.3< 3.3.7-2
  • rubygems< 3.3.15-2+deb12u1 | < 3.6.6-1
Ruby-lang1 product
  • uri< 0.11.3 | ≥ 0.12.0, < 0.12.4 | ≥ 0.13.0, < 0.13.2 | ≥ 1.0.0, < 1.0.3
RubyGems1 product
  • uri< 0.11.3 | ≥ 0.12.0, < 0.12.4 | ≥ 0.13.0, < 0.13.2 | ≥ 1.0.0, < 1.0.3

6 vendors · 79 products

References

17 links
Show all 17 references