[GHSA-22h5-pq3x-2gf2] URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+

[john-halderman]

Updates

• CVSS v4
• Severity

Comments
The severity seems to be incorrect, it should be low.

https://nvd.nist.gov/vuln/detail/CVE-2025-27221
https://www.tenable.com/cve/CVE-2025-27221
https://www.cve.org/CVERecord?id=CVE-2025-27221

[shelbyc]

Hi @john-halderman, we have adjusted the CVSS 4.0 score to CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N to better align with MITRE's CVSS 3.1 score of CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N. Thank you for bringing the severity discrepancy to our attention and have a great day!

[advisory-database]

Hi @john-halderman! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[john-halderman]

@shelbyc I appreciate it, thanks!