PT-2025-40972 · Ruby+8 · Ruby+8

Chongfujun + 2 · Published 2025-01-01 · Updated 2026-05-12 · CVE-2025-61594

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 3.4.7

Description The URI gem contained a flaw that allowed for credential leakage, bypassing previous fixes. This issue impacts systems utilizing the URI gem and could potentially expose sensitive information.

Recommendations Update to Ruby version 3.4.7 or later. Update the uri gem to the latest version.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-212

CWE-200

Related Identifiers

ALSA-2025:23062

ALSA-2025:23063

ALSA-2025:23141

AZL-73356

AZL-73391

BDU:2026-06689

CVE-2025-61594

ECHO-708D-96AD-F256

GHSA-J4PR-3WM6-XX2R

OESA-2025-2655

OPENSUSE-SU-2025:15614-1

USN-8137-1

Affected Products

Almalinux

Centos

Debian

Linuxmint

Red Hat

Red Os

Rocky Linux

Ruby

Ubuntu

References · 72

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61594.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml · Exploit
• https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a · Patch
• https://github.com/ruby/uri/commit/7e521b2da0833d964aab43019e735aea674e1c2c · Patch
• https://github.com/ruby/uri/commit/20157e3e29b125ff41f1d9662e2e3b1d066f5902 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-61594 · Vendor Advisory
• https://ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2025:23063 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-73391 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-61594 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:23062 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:23063 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-61594 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61594 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-73356 · Vendor Advisory