https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:50:34 +0000 https://db.gcve.eu/vuln/ghsa-j4pr-3wm6-xx2r <p><strong>Affected:</strong> RubyGems: uri</p> <p>### Impact</p> <p>In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.</p> <p>When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.</p> <p>The vulnerability affects the `uri` gem bundled with the following Ruby series:</p> <p>* 0.12.4 and earlier (bundled in Ruby 3.2 series) * 0.13.2 and earlier (bundled in Ruby 3.3 series) * 1.0.3 and earlier (bundled in Ruby 3.4 series)</p> <p>### Patches</p> <p>Upgrade to 0.12.5, 0.13.3 or 1.0.4</p> <p>### References</p> <p>* https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/ * https://hackerone.com/reports/2957667</p> <p><strong>Affected:</strong> RubyGems: uri</p> <p>### Impact</p> <p>In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials.</p> <p>When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure.</p> <p>The vulnerability affects the `uri` gem bundled with the following Ruby series:</p> <p>* 0.12.4 and earlier (bundled in Ruby 3.2 series) * 0.13.2 and earlier (bundled in Ruby 3.3 series) * 1.0.3 and earlier (bundled in Ruby 3.4 series)</p> <p>### Patches</p> <p>Upgrade to 0.12.5, 0.13.3 or 1.0.4</p> <p>### References</p> <p>* https://www.ruby-lang.org/en/news/2025/02/26/security-advisories/ * https://hackerone.com/reports/2957667</p> https://db.gcve.eu/vuln/ghsa-j4pr-3wm6-xx2r