CVE-2025-66453

NameCVE-2025-66453
DescriptionRhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1121953

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rhino (PTS)bullseye1.7.7.2-3vulnerable
bookworm1.7.14-2.1vulnerable
forky, sid, trixie1.7.15-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rhinosource(unstable)(unfixed)1121953

Notes

https://github.com/mozilla/rhino/security/advisories/GHSA-3w8q-xq97-5j7x

Search for package or bug name: Reporting problems