CVE-2025-66453
Rhino vulnerable high CPU usage and potential DoS when passing specific numbers to toFixed() function
MEDIUM 5.5
En bref
- Source
- NVD
- EPSS
- EPSS 0.27 % · centile 19 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Analyzed
Description
Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.
Faiblesses (CWE)
- CWE-400 — Consommation de ressources non maîtrisée (déni de service)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 5.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | GitHub_M |
| CVSS 4.0 | MEDIUM 5.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-3w8q-xq97-5j7x — Rhino has high CPU usage and potential DoS when passing specific numbers to `toFixed()` function
Références européennes
- ENISA EUVD · EUVD-2025-201013
- GCVE · GCVE-0-2025-66453
Avis du CERT-FR
- CERTFR-2026-AVI-0327 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:mozilla:rhino:*:*:*:*:*:*:*:*< 1.7.14.1cpe:2.3:a:mozilla:rhino:1.7.15:*:*:*:*:*:*:*cpe:2.3:a:mozilla:rhino:1.8.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| mozilla · rhino | affected >= 1.8.0, < 1.8.1 ; affected >= 1.7.15, < 1.7.15.1 ; affected < 1.7.14.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |