Add advisory for CVE-2025-61594 (URI Credential Leakage Bypass) for Ruby < 3.3.10 and < 3.4.7

[hudakh]

This adds an advisory under rubies/ruby for CVE-2025-61594, affecting Ruby versions before
3.3.10 and 3.4.7. The vulnerability allows credential leakage when combining URIs using the

• operator, as described in https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594/.

Fixed in Ruby 3.3.10 and 3.4.7.

[hudakh]

@jasnow for your review

[jasnow]

Please add this advisory at the bottom of your advisory:
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml

[hudakh]

Please add this advisory at the bottom of your advisory: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-61594.yml

Done. Thanks!

[postmodern]

The ruby-advisory-db YAML schema does not use affected_versions, only patched_versions and unaffected_versions; any other version not in those ranges is considered affected.

[hudakh]

Makes sense! Addressed.

[postmodern]

Might be a good idea to add the links to:

• https://www.cve.org/CVERecord?id=CVE-2025-61594
• https://www.ruby-lang.org/en/news/2025/10/23/ruby-3-3-10-released/
• https://www.ruby-lang.org/en/news/2025/10/07/ruby-3-4-7-released/

[hudakh]

Added