CVE-2025-61594

What it actually does

This vulnerability affects Ruby's URI library when applications use the + operator to combine URI objects. In affected versions, userinfo components such as usernames and passwords from the original URI can be incorrectly retained or propagated into the resulting URI, bypassing the prior fix for a related credential-leak issue. The flaw does not directly provide code execution or privilege escalation; its impact is exposure of sensitive URI-embedded credentials through application behavior such as logging, redirects, error messages, telemetry, outbound requests, or returned API responses. Affected URI versions include 0.12.4 and earlier in the Ruby 3.2 series, 0.13.2 and earlier in the Ruby 3.3 series, and 1.0.3 and earlier in the Ruby 3.4 series.

Why it matters to the business

Applications that construct URLs using Ruby's URI library may unintentionally disclose passwords, API tokens, proxy credentials, database credentials, or service account secrets embedded in URLs. If those values are logged, sent to users, included in monitoring data, or transmitted to third-party services, attackers or unauthorized insiders may be able to reuse the credentials for account takeover, data access, or lateral movement. The issue is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has a low EPSS score, but it remains important for organizations because credential leakage can turn a small application bug into broader compromise if exposed secrets are valid and privileged.

How an attack unfolds

An attacker needs an application path where Ruby URI objects are combined using the + operator and where either the attacker can influence one of the URI values or can cause a sensitive source URI to be processed in a way that exposes the combined result. The attacker supplies or triggers URI input that causes the vulnerable library behavior to preserve credentials from the original URI when the application expected those credentials to be stripped. The resulting URI may then appear in application logs, debugging output, HTTP responses, redirect locations, exception traces, observability pipelines, or outbound requests. The attacker retrieves the leaked URI from any accessible output channel, extracts the username, password, token, or other userinfo value, and attempts to reuse the credential against the referenced service or related systems. No public exploit maturity is indicated in the provided data, and exploitation is generally application-specific rather than a universal remote exploit.

How to fix it

Upgrade the Ruby URI library to a fixed version appropriate for the Ruby series in use: 0.12.5 or later for Ruby 3.2-series deployments, 0.13.3 or later for Ruby 3.3-series deployments, and 1.0.4 or later for Ruby 3.4-series deployments. For source-based consumers of ruby/uri, update to a version containing commit 8cf5a496c1f8e5fe58c0c605ad96d12a051e24c6 or a later release. Where operating-system packages are used, apply vendor updates; the provided Debian 11 package data indicates ntp fixed in 1:4.2.6.p5+dfsg-3.2 where applicable. After upgrading, rebuild containers and redeploy applications so bundled gems and runtime images no longer include vulnerable URI versions. As defense in depth, avoid embedding credentials in URLs, strip userinfo before logging or returning URLs, redact URI authority components in observability pipelines, and rotate any credentials known or suspected to have been exposed.

How to confirm the fix worked

Confirm the installed URI gem or bundled Ruby library version is fixed by checking dependency manifests, lockfiles, package inventories, container images, and runtime versions. For Ruby applications, inspect Gemfile.lock, gemspecs, SBOMs, and runtime output from commands such as gem list uri or ruby -ruri -e 'p Gem.loaded_specs["uri"]&.version.to_s'. Verify that Ruby 3.2 environments use uri 0.12.5 or later, Ruby 3.3 environments use uri 0.13.3 or later, and Ruby 3.4 environments use uri 1.0.4 or later. Review application code for use of URI#+ and add tests that combine URIs containing userinfo to ensure credentials are not retained in the resulting URI. Validate logging and telemetry redaction by generating test URIs with dummy credentials and confirming they do not appear in application logs, HTTP responses, traces, metrics labels, exception reports, or outbound request records.

Typical attack path

1. Identify a Ruby application or service that uses the affected URI library versions and combines URI objects with the + operator.
2. Find an input path, redirect flow, proxy flow, webhook handler, crawler, integration, or parsing feature where URI values are accepted or transformed.
3. Submit or trigger crafted URI input that causes sensitive userinfo from an original URI to be retained in a newly combined URI.
4. Cause the application to expose the resulting URI through logs, error output, responses, redirects, telemetry, or outbound network requests.
5. Collect the leaked URI and extract embedded credentials from the userinfo portion before the @ character.
6. Attempt credential reuse against the referenced service, adjacent integrations, or other systems where the same secret may be valid.

How to detect it

Detection should focus on evidence of credential disclosure rather than a reliable exploit signature. Review application logs, web server logs, reverse proxy logs, exception traces, APM traces, distributed tracing spans, HTTP access logs, redirect logs, background job logs, and outbound request logs for URLs containing userinfo in the authority section, especially values matching scheme://username:password@host. Search around features that parse, normalize, combine, redirect, fetch, proxy, or display URLs. Review source code and runtime traces for calls to URI#+ or equivalent URI combination behavior in Ruby applications. Investigate any historical log entries where credentials appear before an @ sign in a URL, determine whether those logs were accessible to users, support staff, vendors, or attackers, and rotate exposed secrets. Also check SIEM, log aggregation, crash reporting, and observability platforms because credential-bearing URLs may have been copied from application logs into downstream telemetry. There are no known threat actors or campaigns in the provided data; therefore, absence of known actor tooling should not be treated as proof of no exposure.

• URI#+
• gem list uri
• uri (0.12.4)
• uri (0.13.2)
• uri (1.0.3)
• Gem.loaded_specs["uri"]
• Gemfile.lock
• uri (0.12.
• uri (0.13.
• uri (1.0.
• ruby/uri
• 8cf5a496c1f8e5fe58c0c605ad96d12a051e24c6
• ://[^/@:]+:[^/@]+@
• http://[^/@:]+:[^/@]+@
• https://[^/@:]+:[^/@]+@
• ftp://[^/@:]+:[^/@]+@
• proxy://[^/@:]+:[^/@]+@
• postgres://[^/@:]+:[^/@]+@
• mysql://[^/@:]+:[^/@]+@
• redis://[^/@:]+:[^/@]+@
• mongodb://[^/@:]+:[^/@]+@

What your security team should do

• Inventory Ruby applications, containers, build images, and dependency lockfiles for affected URI versions: 0.12.4 and earlier, 0.13.2 and earlier, and 1.0.3 and earlier.
• Prioritize remediation for internet-facing services, systems that process user-supplied URLs, webhook processors, API gateways, proxies, crawlers, SSO/OAuth integrations, and applications that handle URLs containing credentials or tokens.
• Upgrade to uri 0.12.5, 0.13.3, or 1.0.4 as appropriate, or consume a vendor package containing the fixed ruby/uri commit 8cf5a496c1f8e5fe58c0c605ad96d12a051e24c6.
• Search codebases for URI#+ usage and add safe helper functions that strip userinfo before logging, displaying, redirecting, or transmitting constructed URLs.
• Harden log pipelines and error reporting tools to redact URI userinfo patterns globally, regardless of application-level fixes.
• Review historical logs and telemetry for URLs containing embedded credentials, then rotate any exposed passwords, API keys, proxy credentials, or service tokens.
• Because this issue is not KEV-listed, not reported as ransomware-used, and has low EPSS, handle it as a credential-exposure remediation priority rather than an emergency remote-code-execution event unless sensitive secrets are confirmed exposed.