CVE-2025-66453

🗓️ 03 Dec 2025 19:31:54Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 21 Views

Rhino is vulnerable to high CPU and denial of service when a crafted float is passed to toFixed; fixed in 1.8.1, 1.7.15.1, 1.7.14.1.

Reporter	Title	Published	Views	Family All 50
IBM Security Bulletins	Security Bulletin: IBM DevOps Release addresses multiple vulnerabilities related to Apache Tomcat.	24 Mar 202613:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM webMethods BPM is vulnerable to a denial of service due to rhino	30 Mar 202605:52	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Rhino JAR , IBM Sterling Connect:Direct Web Services is affected by high CPU consumption and a potential Denial of Service issue.	16 Feb 202605:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is affected by denial of service vulnerabilities in Db2 JSON Store Technology Preview [CVE-2025-66453]	17 Feb 202622:09	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in rhino-1.7.15.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2025-66453)	2 Mar 202610:05	–	ibm
IBM Security Bulletins	Security Bulletin: Rhino CVE-2025-66453 security vulnerability in FileNet Content Manager	15 Apr 202611:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Automation Decision Services for April 2026- Multiple CVEs addressed	8 May 202606:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Build addresses multiple vulnerabilities.	25 Mar 202613:04	–	ibm
Tenable Nessus	Amazon Linux 2023 : rhino, rhino-engine, rhino-javadoc (ALAS2023-2025-1339)	8 Jan 202600:00	–	nessus
Tenable Nessus	openSUSE 16 Security Update : rhino (openSUSE-SU-2026:20297-1)	6 Mar 202600:00	–	nessus

NVD

Vulners

Node

mozilla rhinoRange<1.7.14.1

mozilla rhinoMatch1.7.15

mozilla rhinoMatch1.8.0

[
  {
    "vendor": "mozilla",
    "product": "rhino",
    "versions": [
      {
        "version": ">= 1.8.0, < 1.8.1",
        "status": "affected"
      },
      {
        "version": ">= 1.7.15, < 1.7.15.1",
        "status": "affected"
      },
      {
        "version": "< 1.7.14.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/mozilla/rhino/security/advisories/GHSA-3w8q-xq97-5j7x

14 Apr 2026 15:39Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.17.5

CVSS 46.9

EPSS0.00115

SSVC

CWE-400