{"id":"CVE-2025-0306","aliases":["AZL-110513","DEBIAN-CVE-2025-0306","EUVD-2025-1595","GHSA-vvxp-46w2-6p8r"],"status":"published","title":"Ruby: openssl: ruby marvin attack","description":"A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00658,"percentile":0.51788,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-385"],"published":"2025-01-09T04:05:42Z","modified":"2026-11-05T14:45:54Z","affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.3.5-10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby3.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-7","3.1.2-7+deb12u1","3.1.2-7+hurd.1","3.1.2-8","3.1.2-8.1~exp1","3.1.2-8.3","3.1.2-8.4","3.1.2-8.5"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat storage 3"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-0306","tags":["vdb-entry","x_refsource_REDHAT","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2336100","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.netapp.com/advisory/ntap-20250221-0009/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0306","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20250221-0009"},{"url":"https://github.com/advisories/GHSA-vvxp-46w2-6p8r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-0306","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-0306","title":"Ruby: openssl: ruby marvin attack","description":"A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.","status":"published","published":"2025-01-09T04:05:42.194Z","modified":"2026-11-05T14:45:54.824Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-385"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2025-1595","description":"A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.","status":"published","published":"2025-01-09T04:05:42Z","modified":"2026-11-05T14:45:54Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-05T16:59:57.067043Z"}],"ghsa":[{"id":"GHSA-vvxp-46w2-6p8r","title":"A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This...","description":"A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.","status":"published","published":"2025-01-09T06:30:23Z","modified":"2025-02-21T18:32:10Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-385"],"updated_at":"2026-11-02T15:00:00.252144Z"}],"nvd":[{"id":"CVE-2025-0306","description":"A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.","status":"published","published":"2025-01-09T04:15:13Z","modified":"2026-11-05T15:17:06.027Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-385"],"updated_at":"2026-11-05T19:55:50.758755Z"}],"osv":[{"id":"DEBIAN-CVE-2025-0306","description":"A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.","status":"published","published":"2025-01-09T04:15:13Z","modified":"2026-09-01T20:05:39.636545975Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"AZL-110513","title":"CVE-2025-0306 affecting package ruby 3.3.5-10","description":"A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.","status":"published","published":"2025-01-09T04:15:13Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:02.368326Z"},{"id":"CVE-2025-0306","description":"A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.","status":"published","published":"2025-01-09T04:15:13Z","modified":"2026-04-10T05:20:14.882681Z","updated_at":"2026-11-02T15:44:45.712478Z"}]}}