RubyGems/jruby-openssl CVE-2025-46551: low 3.7, EPSS 0.20%
JRuby-OpenSSL has hostname verification disabled by default
Action: Upgrade jruby-openssl to 0.15.4 or later.
bundle update jruby-opensslAffected
| introduced | fixed | last affected |
|---|---|---|
| 0.12.1 | 0.15.4 | - |
Fixed versions
| 0.15.4 |
Sources
- osv: GHSA-72qj-48g4-5xgx
- nvd: CVE-2025-46551
- https://github.com/jruby/jruby-openssl/security/advisories/GHSA-72qj-48g4-5xgx
- https://github.com/jruby/jruby-openssl/commit/31a56d690ce9b8af47af09aaaf809081949ed285
- https://github.com/jruby/jruby-openssl/commit/b1fc5d645c0d90891b8865925ac1c15e3f15a055
- https://github.com/jruby/jruby-openssl
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jruby-openssl/CVE-2025-46551.yml
CVE-2025-46551 · published · modified · JSON