CVE-2025-46551 JRuby-OpenSSL has hostname verification disabled by default
JRuby-OpenSSL fails to verify hostnames in SSL certificates, allowing man-in-the-middle attacks against applications using JRuby for secure connections.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-46551?
CVE-2025-46551 is a medium-severity vulnerability in jruby-openssl, published on 7 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
JRuby-OpenSSL is an add-on gem for JRuby that emulates the Ruby OpenSSL native library. Starting in JRuby-OpenSSL version 0.12.1 and prior to version 0.15.4 (corresponding to JRuby versions starting in 9.3.4.0 prior to 9.4.12.1 and 10.0.0.0 prior to 10.0.0.1), when verifying SSL certificates, JRuby-OpenSSL does not verify that the hostname presented in the certificate matches the one the user tries to connect to. This means a man-in-the-middle could just present any valid cert for a completely different domain they own, and JRuby would accept the cert. Anybody using JRuby to make requests of external APIs, or scraping the web, that depends on https to connect securely. JRuby-OpenSSL version 0.15.4 contains a fix for the issue. This fix is included in JRuby versions 10.0.0.1 and 9.4.12.1.
Weakness: CWE-295
Which versions are affected by CVE-2025-46551?
8 open source packages ship an affected version, including rubygems:jruby-openssl, org.jruby:jruby and jruby-openssl. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
rubygems:jruby-openssl Maven | From 0.12.1 | 0.15.4 |
rubygems:jruby-openssl Maven | From 0.12.1 | 0.15.4 |
org.jruby:jruby Maven | From 10.0.0.0 | 10.0.0.1 |
org.jruby:jruby Maven | From 10.0.0.0 | 10.0.0.1 |
org.jruby:jruby Maven | From 9.3.4.0 | 9.4.12.1 |
org.jruby:jruby Maven | From 9.3.4.0 | 9.4.12.1 |
2 more packages
jruby-openssl RubyGems | From 0.12.1 | 0.15.4 |
jruby-openssl RubyGems | From 0.12.1 | 0.15.4 |
Products include Jruby Jruby, Jruby Jruby-Openssl.
How do I fix CVE-2025-46551?
Upgrade rubygems:jruby-openssl to 0.15.4 or later.
Is CVE-2025-46551 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46551 exists.
Other vulnerabilities in jruby-openssl
Sources
Also known as CLEANSTART-2026-OD65831, ECHO-b49a-ed3a-3f0a, GHSA-72qj-48g4-5xgx, MINI-775v-qpmr-4f92, MINI-9mh2-2r3m-m99q, MINI-mg84-gfww-c4fc and 3 more.