The uri gem versions prior to 0.11.3, between 0.12.0 and 0.12.3, 0.13.0 to 0.13.1, and 1.0.0 to 1.0.2 allow userinfo leakage via the URI#join, URI#merge, and URI#+ methods. These methods retain userinfo such as user credentials even after the host component is replaced, potentially exposing sensitive information when generating URLs to malicious hosts. The issue is fixed in versions 0.11.3, 0.12.4, 0.13.2, and 1.0.3 or later.