{"answers":{"affected":"6 open source packages ship an affected version, including org.mozilla:rhino. It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-66453 in the wild and no public exploit code.","fix":"Upgrade org.mozilla:rhino to a fixed version for your release line: 1.7.14.1, 1.7.15.1 or 1.8.1.","what":"CVE-2025-66453 is a medium-severity denial of service vulnerability in mozilla rhino, published on 3 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-66453 and fix it if it is affected.\n\nWhat it is: CVE-2025-66453 is a medium-severity denial of service vulnerability in mozilla rhino, published on 3 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-66453 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- org.mozilla:rhino (Maven): affected all versions; fixed in 1.7.14.1\n- org.mozilla:rhino (Maven): affected all versions; fixed in 1.7.14.1\n- org.mozilla:rhino (Maven): affected from 1.7.15; fixed in 1.7.15.1\n- org.mozilla:rhino (Maven): affected from 1.7.15; fixed in 1.7.15.1\n- org.mozilla:rhino (Maven): affected from 1.8.0; fixed in 1.8.1\n- org.mozilla:rhino (Maven): affected from 1.8.0; fixed in 1.8.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-66453/ (Markdown: https://insights.sbomify.com/CVE-2025-66453/index.md)","id":"CVE-2025-66453","markdown":"https://insights.sbomify.com/CVE-2025-66453/index.md","name":"CVE-2025-66453","record":{"aliases":["AZL-71221","AZL-71503","CLSA-2026-1771459787","CLSA-2026-1771546195","DEBIAN-CVE-2025-66453","GHSA-3w8q-xq97-5j7x","SUSE-SU-2025:4390-1","SUSE-SU-2026:20603-1","UBUNTU-CVE-2025-66453","openSUSE-SU-2025:15798-1","openSUSE-SU-2026:20297-1"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Java JavaScript engine","requires_auth":"none","summary":"Attackers can cause high CPU usage and denial of service by passing specific floating-point numbers to the toFixed() function in the Rhino JavaScript engine.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"rhino","vendor":"mozilla"}],"cvss":{"score":5.5,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","version":"4.0"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"description":"Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo \u003e DToA.JS_dtostr \u003e DToA.JS_dtoa \u003e DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.","ecosystems":["Maven","SUSE:Linux Enterprise Module for Basesystem 15 SP6","SUSE:Linux Enterprise Module for Basesystem 15 SP7","SUSE:Linux Enterprise Server 16.0","SUSE:Linux Enterprise Server for SAP applications 16.0","openSUSE:Leap 15.6","openSUSE:Leap 16.0","openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Rhino vulnerable high CPU usage and potential DoS when passing specific numbers to toFixed() function","id":"CVE-2025-66453","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"denial_of_service","year":"2025"},"n_packages":13,"n_references":1,"next":{"headline":"Arcade MCP Default Hardcoded Worker Secret Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints","id":"CVE-2025-66454"},"packages":[{"ecosystem":"Maven","fixed":["1.7.14.1"],"introduced":["0"],"last_affected":[],"package":"org.mozilla:rhino","purl":null,"source":"GHSA-3w8q-xq97-5j7x"},{"ecosystem":"Maven","fixed":["1.7.14.1"],"introduced":["0"],"last_affected":[],"package":"org.mozilla:rhino","purl":"pkg:maven/org.mozilla/rhino","source":"GHSA-3w8q-xq97-5j7x"},{"ecosystem":"Maven","fixed":["1.7.15.1"],"introduced":["1.7.15"],"last_affected":[],"package":"org.mozilla:rhino","purl":null,"source":"GHSA-3w8q-xq97-5j7x"},{"ecosystem":"Maven","fixed":["1.7.15.1"],"introduced":["1.7.15"],"last_affected":[],"package":"org.mozilla:rhino","purl":"pkg:maven/org.mozilla/rhino","source":"GHSA-3w8q-xq97-5j7x"},{"ecosystem":"Maven","fixed":["1.8.1"],"introduced":["1.8.0"],"last_affected":[],"package":"org.mozilla:rhino","purl":null,"source":"GHSA-3w8q-xq97-5j7x"},{"ecosystem":"Maven","fixed":["1.8.1"],"introduced":["1.8.0"],"last_affected":[],"package":"org.mozilla:rhino","purl":"pkg:maven/org.mozilla/rhino","source":"GHSA-3w8q-xq97-5j7x"},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","fixed":["1.7.15.1-150200.12.7.1"],"introduced":["0"],"last_affected":[],"package":"rhino","purl":"pkg:rpm/suse/rhino\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6","source":"SUSE-SU-2025:4390-1"},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","fixed":["1.7.15.1-150200.12.7.1"],"introduced":["0"],"last_affected":[],"package":"rhino","purl":"pkg:rpm/suse/rhino\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7","source":"SUSE-SU-2025:4390-1"},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","fixed":["1.7.15.1-160000.1.1"],"introduced":["0"],"last_affected":[],"package":"rhino","purl":"pkg:rpm/suse/rhino\u0026distro=SUSE%20Linux%20Enterprise%20Server%2016.0","source":"SUSE-SU-2026:20603-1"},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","fixed":["1.7.15.1-160000.1.1"],"introduced":["0"],"last_affected":[],"package":"rhino","purl":"pkg:rpm/suse/rhino\u0026distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0","source":"SUSE-SU-2026:20603-1"},{"ecosystem":"openSUSE:Leap 15.6","fixed":["1.7.15.1-150200.12.7.1"],"introduced":["0"],"last_affected":[],"package":"rhino","purl":"pkg:rpm/opensuse/rhino\u0026distro=openSUSE%20Leap%2015.6","source":"SUSE-SU-2025:4390-1"},{"ecosystem":"openSUSE:Leap 16.0","fixed":["1.7.15.1-160000.1.1"],"introduced":["0"],"last_affected":[],"package":"rhino","purl":"pkg:rpm/opensuse/rhino\u0026distro=openSUSE%20Leap%2016.0","source":"openSUSE-SU-2026:20297-1"},{"ecosystem":"openSUSE:Tumbleweed","fixed":["1.7.15.1-1.1"],"introduced":["0"],"last_affected":[],"package":"rhino","purl":"pkg:rpm/opensuse/rhino\u0026distro=openSUSE%20Tumbleweed","source":"openSUSE-SU-2025:15798-1"}],"prev":{"headline":"LibreChat's lack of JSON parsing error handling can lead to XSS","id":"CVE-2025-66452"},"products":["rhino"],"published":"2025-12-03","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"SUSE"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-12-03","vendors":["mozilla"]},"summary":"Attackers can cause high CPU usage and denial of service by passing specific floating-point numbers to the toFixed() function in the Rhino JavaScript engine.","url":"https://insights.sbomify.com/CVE-2025-66453/"}