CVE-2025-66453

Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/mozilla/rhino/security/advisories/GHSA-3w8q-xq97-5j7x	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mozilla:rhino::::::::
	cpe:2.3:a:mozilla:rhino:1.7.15:::::::*
	cpe:2.3:a:mozilla:rhino:1.8.0:::::::*

History

18 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Rhino es una implementación de código abierto de JavaScript escrita completamente en Java. Versiones anteriores a 1.8.1, 1.7.15.1 y 1.7.14.1, cuando una aplicación pasaba un número de punto flotante controlado por un atacante a la función 'toFixed()', esto podría llevar a un alto consumo de CPU y a una potencial denegación de servicio. Los números pequeños pasan por esta pila de llamadas: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult, donde 'pow5mult' intenta elevar 5 a una potencia ridícula. Esta vulnerabilidad está corregida en 1.8.1, 1.7.15.1 y 1.7.14.1.

Information

Published : 2025-12-03 20:16

Updated : 2026-10-18 17:10

NVD link : CVE-2025-66453

Mitre link : CVE-2025-66453

CVE.ORG link : CVE-2025-66453

JSON object : View

Products Affected

mozilla

rhino

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2025-66453", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66453", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T19:43:43.562652Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mozilla", "product": "rhino", "versions": [{"status": "affected", "version": ">= 1.8.0, < 1.8.1"}, {"status": "affected", "version": ">= 1.7.15, < 1.7.15.1"}, {"status": "affected", "version": "< 1.7.14.1"}]}]}], "published": "2025-12-03T20:16:26.897", "references": [{"url": "https://github.com/mozilla/rhino/security/advisories/GHSA-3w8q-xq97-5j7x", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1."}, {"lang": "es", "value": "Rhino es una implementaci\u00f3n de c\u00f3digo abierto de JavaScript escrita completamente en Java. Versiones anteriores a 1.8.1, 1.7.15.1 y 1.7.14.1, cuando una aplicaci\u00f3n pasaba un n\u00famero de punto flotante controlado por un atacante a la funci\u00f3n 'toFixed()', esto podr\u00eda llevar a un alto consumo de CPU y a una potencial denegaci\u00f3n de servicio. Los n\u00fameros peque\u00f1os pasan por esta pila de llamadas: NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult, donde 'pow5mult' intenta elevar 5 a una potencia rid\u00edcula. Esta vulnerabilidad est\u00e1 corregida en 1.8.1, 1.7.15.1 y 1.7.14.1."}], "lastModified": "2026-10-18T17:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:rhino:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "061BECFF-1251-4087-9BF8-CA70D17D9AAD", "versionEndExcluding": "1.7.14.1"}, {"criteria": "cpe:2.3:a:mozilla:rhino:1.7.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "560BC060-5CBA-4BF4-8169-9F23D27BF729"}, {"criteria": "cpe:2.3:a:mozilla:rhino:1.8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5E0825A-E0C9-48D8-800C-888160052EFF"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}