CVE-2025-66453

Name of the Vulnerable Software and Affected Versions Rhino versions prior to 1.8.1 Rhino versions prior to 1.7.15.1 Rhino versions prior to 1.7.14.1

Description Rhino is a JavaScript implementation written in Java. Prior to versions 1.8.1, 1.7.15.1, and 1.7.14.1, providing a crafted floating-point number to the toFixed() function could result in excessive CPU usage, potentially leading to a Denial of Service. The issue occurs within the following call stack: NativeNumber.numTo > DToA.JS dtostr > DToA.JS dtoa > DToA.pow5mult, where the pow5mult function attempts to raise 5 to a very large power.

Recommendations Rhino versions prior to 1.8.1 should be updated to version 1.8.1 or later. Rhino versions prior to 1.7.15.1 should be updated to version 1.7.15.1 or later. Rhino versions prior to 1.7.14.1 should be updated to version 1.7.14.1 or later.