Most recent entries from all

bdu:2026-06689

BELL-CVE-2025-61594

Affected: Alpaquita:23: ruby, Alpaquita:25: ruby, Alpaquita:stream: ruby

BREW-krane-CVE-2025-61594 — URI Credential Leakage Bypass over CVE-2025-27221

Affected: Homebrew: krane

### Impact

In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.

When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.

The vulnerability affects the `uri` gem bundled with the following Ruby series:

* 0.12.4 and earlier (bundled in Ruby 3.2 series) * 0.13.2 and earlier (bundled in Ruby 3.3 series) * 1.0.3 and earlier (bundled in Ruby 3.4 series)

### Patches

Upgrade to 0.12.5, 0.13.3 or 1.0.4

### References

* https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/ * https://hackerone.com/reports/2957667

certfr-2026-avi-0112 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2026-avi-0112

CLEANSTART-2026-TF01901 — Security fix for CVE-2025-61594 applied in: logstash-fips 9.2.4-r2, ruby 3.4.9-r0

Affected: CleanStart: logstash-fips, CleanStart: ruby

CVE-2025-61594 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-291773

fkie_cve-2025-61594

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.

GHSA-j4pr-3wm6-xx2r — URI Credential Leakage Bypass over CVE-2025-27221

Affected: RubyGems: uri

### Impact

In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.

When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.

The vulnerability affects the `uri` gem bundled with the following Ruby series:

* 0.12.4 and earlier (bundled in Ruby 3.2 series) * 0.13.2 and earlier (bundled in Ruby 3.3 series) * 1.0.3 and earlier (bundled in Ruby 3.4 series)

### Patches

Upgrade to 0.12.5, 0.13.3 or 1.0.4

### References

* https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/ * https://hackerone.com/reports/2957667

msrc_CVE-2025-61594 — URI Credential Leakage Bypass over CVE-2025-27221

msrc_CVE-2025-61594

OESA-2025-2655 — ruby security update

Affected: openEuler:22.03-LTS-SP3: ruby, openEuler:22.03-LTS-SP4: ruby, openEuler:24.03-LTS: ruby, openEuler:24.03-LTS-SP1: ruby, openEuler:24.03-LTS-SP2: ruby, openEuler:20.03-LTS-SP4: ruby

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks (such as Perl). Security Fix(es):

REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.(CVE-2025-58767)

Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the use of the `+` operator when combining URIs. An attacker can obtain sensitive user credentials by crafting a URI that, when merged with another, results in the unintended exposure of authentication information.

**Note:** This vulnerability is a bypass of the fix to CVE-2025-27221.(CVE-2025-61594)

openSUSE-SU-2025:15614-1 — libruby3_4-3_4-3.4.7-1.1 on GA media

libruby3_4-3_4-3.4.7-1.1 on GA media

UBUNTU-CVE-2025-61594

Affected: Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:Pro:18.04:LTS: ruby2.5, Ubuntu:Pro:20.04:LTS: ruby2.7, Ubuntu:22.04:LTS: ruby3.0, Ubuntu:24.04:LTS: ruby3.2, Ubuntu:25.10: ruby3.3, Ubuntu:26.04:LTS: ruby3.3

WID-SEC-W-2025-2215 — Ruby: Schwachstelle ermöglicht Offenlegung von Informationen

Ein entfernter Angreifer kann eine Schwachstelle in Ruby ausnutzen, um Informationen offenzulegen