PT-2025-48990 · Mozilla+2 · Rhino+2
Published
2025-12-03
·
Updated
2026-03-02
·
CVE-2025-66453
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Rhino versions prior to 1.8.1
Rhino versions prior to 1.7.15.1
Rhino versions prior to 1.7.14.1
Description
Rhino is a JavaScript implementation written in Java. Prior to versions 1.8.1, 1.7.15.1, and 1.7.14.1, providing a crafted floating-point number to the
toFixed() function could result in excessive CPU usage, potentially leading to a Denial of Service. The issue occurs within the following call stack: NativeNumber.numTo > DToA.JS dtostr > DToA.JS dtoa > DToA.pow5mult, where the pow5mult function attempts to raise 5 to a very large power.Recommendations
Rhino versions prior to 1.8.1 should be updated to version 1.8.1 or later.
Rhino versions prior to 1.7.15.1 should be updated to version 1.7.15.1 or later.
Rhino versions prior to 1.7.14.1 should be updated to version 1.7.14.1 or later.
Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Rhino
Suse