Maven/org.jruby:jruby CVE-2025-46551: low 3.7, EPSS 0.20%
JRuby-OpenSSL has hostname verification disabled by default
Action: Upgrade org.jruby:jruby to 9.4.12.1 (9.x) or 10.0.0.1 (10.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 10.0.0.0 | 10.0.0.1 | - |
| 9.3.4.0 | 9.4.12.1 | - |
Fixed versions
| 10.0.0.1 | 9.4.12.1 |
Sources
- osv: GHSA-72qj-48g4-5xgx#Maven/org.jruby:jruby
- nvd: CVE-2025-46551
- https://github.com/jruby/jruby-openssl/security/advisories/GHSA-72qj-48g4-5xgx
- https://github.com/jruby/jruby-openssl/commit/31a56d690ce9b8af47af09aaaf809081949ed285
- https://github.com/jruby/jruby-openssl/commit/b1fc5d645c0d90891b8865925ac1c15e3f15a055
- https://github.com/jruby/jruby-openssl
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jruby-openssl/CVE-2025-46551.yml
CVE-2025-46551 · published · modified · JSON