{"id":"CVE-2025-66453","aliases":["AZL-71221","AZL-71503","CLSA-2026-1771459787","CLSA-2026-1771546195","DEBIAN-CVE-2025-66453","EUVD-2025-201013","GHSA-3w8q-xq97-5j7x","SUSE-SU-2025:4390-1","SUSE-SU-2026:20603-1","UBUNTU-CVE-2025-66453","openSUSE-SU-2025:15798-1","openSUSE-SU-2026:20297-1"],"status":"published","title":"Rhino vulnerable high CPU usage and potential DoS when passing specific numbers to toFixed() function","description":"Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo \u003e DToA.JS_dtostr \u003e DToA.JS_dtoa \u003e DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.","severity":{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00291,"percentile":0.21898,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2025-12-03T16:57:50Z","modified":"2026-11-02T19:45:19Z","fixes":[{"ecosystem":"Maven","package":"org.mozilla:rhino","fixed_in":["1.7.14.1","1.7.15.1","1.8.1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"rhino","fixed_in":["1.7.15.1-1"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.mozilla:rhino","fixed_in":["1.7.10-tuxcare.1","1.7.15-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rhino","fixed_in":["1.7.14.1-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rhino","fixed_in":["1.7.15.1-0.1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rhino","fixed_in":["1.7.15.1-0.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"rhino","fixed_in":["1.7.15.1-150200.12.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"rhino","fixed_in":["1.7.15.1-150200.12.7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"rhino","fixed_in":["1.7.15.1-150200.12.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rhino","fixed_in":["1.7.15.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rhino","fixed_in":["1.7.15.1-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rhino","fixed_in":["1.7.15.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"rhino","fixed_in":["1.7.15.1-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.mozilla:rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.14.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mozilla:rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.15"},{"fixed":"1.7.15.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mozilla:rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"last_affected":"1.8.0"},{"fixed":"1.8.1"}]}],"versions":["1.8.0"]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.7.7.1-2"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.mozilla:rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.10"},{"fixed":"1.7.10-tuxcare.1"}]}],"versions":["1.7.10"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.mozilla:rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.15"},{"fixed":"1.7.15-tuxcare.1"}]}],"versions":["1.7.15"]},{"source":"osv","ecosystem":"Debian:12","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.14.1-0+deb12u1"}]}],"versions":["1.7.14-2.1"]},{"source":"osv","ecosystem":"Debian:13","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15.1-0.1~deb13u1"}]}],"versions":["1.7.15-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15.1-0.1"}]}],"versions":["1.7.15-1","1.7.15.1-0.1~deb13u1"]},{"source":"osv","ecosystem":"Maven","package":"org.mozilla:rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.14.1"}]}],"versions":["1.7.10","1.7.11","1.7.11-RC1","1.7.11-RC2","1.7.12","1.7.13","1.7.14","1.7.14-RC1","1.7.6","1.7.7","1.7.7.1","1.7.7.2","1.7.8","1.7.8-RC1","1.7.9","1.7R3","1.7R4","1.7R5"]},{"source":"osv","ecosystem":"Maven","package":"org.mozilla:rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.15"},{"fixed":"1.7.15.1"}]}],"versions":["1.7.15"]},{"source":"osv","ecosystem":"Maven","package":"org.mozilla:rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.8.1"}]}],"versions":["1.8.0"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15.1-150200.12.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15.1-150200.12.7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15.1-150200.12.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15.1-160000.1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7R4-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.7.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.7.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.7.2-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.14-2.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.15-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.15-1build1","1.7.15.1-0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.15-1","1.7.15-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rhino","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.15.1-160000.1.1"}]}]}],"products":[{"vendor":"mozilla","product":"rhino"}],"references":[{"url":"https://github.com/mozilla/rhino/security/advisories/GHSA-3w8q-xq97-5j7x","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/mozilla/rhino/commit/2bcf4c43deace35f1f57d86377c6767b0608986e","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66453","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-3w8q-xq97-5j7x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66453.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-66453","tags":["advisory"]},{"url":"https://github.com/mozilla/rhino","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254390-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254481","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66453","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620603-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-66453","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66453","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-66453","title":"Rhino vulnerable high CPU usage and potential DoS when passing specific numbers to toFixed() function","description":"Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo \u003e DToA.JS_dtostr \u003e DToA.JS_dtoa \u003e DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.","status":"published","published":"2025-12-03T19:31:54.629Z","modified":"2025-12-03T19:43:58.83Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:53.157279Z"}],"euvd":[{"id":"EUVD-2025-201013","description":"Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo \u003e DToA.JS_dtostr \u003e DToA.JS_dtoa \u003e DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.","status":"published","published":"2025-12-03T19:31:54Z","modified":"2025-12-03T19:43:58Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T19:49:10.321316Z"}],"ghsa":[{"id":"GHSA-3w8q-xq97-5j7x","title":"Rhino has high CPU usage and potential DoS when passing specific numbers to `toFixed()` function","description":"When an application passed an attacker controlled float poing number into the `toFixed()` function, it might lead to high CPU consumption and a potential Denial of Service.\n\nSmall numbers go through this call stack: `NativeNumber.numTo \u003e DToA.JS_dtostr \u003e DToA.JS_dtoa \u003e DToA.pow5mult`\nwhere `pow5mult` attempts to raise `5` to a ridiculous power.\n\nExample code: `(4.47118444E-314).toFixed(2)`","status":"published","published":"2025-12-03T16:57:50Z","modified":"2025-12-04T16:23:22Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:39:11.110487Z"}],"nvd":[{"id":"CVE-2025-66453","description":"Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo \u003e DToA.JS_dtostr \u003e DToA.JS_dtoa \u003e DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.","status":"published","published":"2025-12-03T20:16:26.897Z","modified":"2026-10-18T17:10:00.11Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:11:47.746175Z"}],"osv":[{"id":"CVE-2025-66453","title":"Rhino vulnerable high CPU usage and potential DoS when passing specific numbers to toFixed() function","description":"Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo \u003e DToA.JS_dtostr \u003e DToA.JS_dtoa \u003e DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.","status":"published","published":"2025-12-03T19:31:54.629Z","modified":"2026-10-28T02:30:26.267804279Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:52.202386Z"},{"id":"DEBIAN-CVE-2025-66453","description":"Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo \u003e DToA.JS_dtostr \u003e DToA.JS_dtoa \u003e DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.","status":"published","published":"2025-12-03T20:16:26.897Z","modified":"2026-10-23T17:47:49.956615359Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"GHSA-3w8q-xq97-5j7x","title":"Rhino has high CPU usage and potential DoS when passing specific numbers to `toFixed()` function","description":"When an application passed an attacker controlled float poing number into the `toFixed()` function, it might lead to high CPU consumption and a potential Denial of Service.\n\nSmall numbers go through this call stack: `NativeNumber.numTo \u003e DToA.JS_dtostr \u003e DToA.JS_dtoa \u003e DToA.pow5mult`\nwhere `pow5mult` attempts to raise `5` to a ridiculous power.\n\nExample code: `(4.47118444E-314).toFixed(2)`","status":"published","published":"2025-12-03T16:57:50Z","modified":"2025-12-05T12:28:14.329367Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"UBUNTU-CVE-2025-66453","description":"Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo \u003e DToA.JS_dtostr \u003e DToA.JS_dtoa \u003e DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.","status":"published","published":"2025-12-03T20:16:00Z","modified":"2026-10-17T12:57:29.226360954Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"AZL-71221","title":"CVE-2025-66453 affecting package rhino for versions less than 1.7.15.1-1","description":"Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo \u003e DToA.JS_dtostr \u003e DToA.JS_dtoa \u003e DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.","status":"published","published":"2025-12-03T20:16:26Z","modified":"2026-04-21T04:53:00.687926Z","updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"AZL-71503","title":"CVE-2025-66453 affecting package rhino 1.7.7.1-2","description":"Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker controlled float poing number into the toFixed() function, it might lead to high CPU consumption and a potential Denial of Service. Small numbers go through this call stack: NativeNumber.numTo \u003e DToA.JS_dtostr \u003e DToA.JS_dtoa \u003e DToA.pow5mult where pow5mult attempts to raise 5 to a ridiculous power. This vulnerability is fixed in 1.8.1, 1.7.15.1, and 1.7.14.1.","status":"published","published":"2025-12-03T20:16:26Z","modified":"2026-04-21T04:36:36.247154Z","updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CLSA-2026-1771459787","title":"TuxCare security update for org.mozilla:rhino (1 CVE)","description":"TuxCare rebuilt org.mozilla:rhino to address 1 CVE. Fixed in 1.7.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T09:46:17.055407258Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1771546195","title":"TuxCare security update for org.mozilla:rhino (1 CVE)","description":"TuxCare rebuilt org.mozilla:rhino to address 1 CVE. Fixed in 1.7.15-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:19.550062395Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"openSUSE-SU-2025:15798-1","title":"rhino-1.7.15.1-1.1 on GA media","description":"These are all security issues fixed in the rhino-1.7.15.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-12-05T00:00:00Z","modified":"2026-03-23T04:54:11.506794Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20297-1","title":"Security update for rhino","description":"This update for rhino fixes the following issues:\n\nUpdate to 1.7.15.1:\n\n- CVE-2025-66453: Fixed a problem with formatting of floating-point numbers to strings that may result in DoS (bsc#1254481).\n","status":"published","published":"2026-03-02T16:00:37Z","modified":"2026-03-23T04:54:49.787513Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2025:4390-1","title":"Security update for rhino","description":"This update for rhino fixes the following issues:\n\nUpdate to version 1.7.15.1.\n\nSecurity issues fixed:\n\n- CVE-2025-66453: high CPU consumption when processing specific numbers via the `toFixed()` function (bsc#1254481).\n\nOther changes and issues fixed:\n  \n- Version 1.7.15:\n  * Basic support for 'rest parameters'.\n  * Improvements in Unicode support.\n  * 'Symbol.species' implemented in many places.\n  * More correct property ordering in many places.\n  * Miscellaneous improvements and bug fixes.\n","status":"published","published":"2025-12-12T16:18:03Z","modified":"2026-02-04T02:26:29.233572Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2026:20603-1","title":"Security update for rhino","description":"This update for rhino fixes the following issues:\n\nUpdate to 1.7.15.1:\n\n- CVE-2025-66453: Fixed a problem with formatting of floating-point numbers to strings that may result in DoS (bsc#1254481).\n","status":"published","published":"2026-03-02T16:00:39Z","modified":"2026-03-23T04:53:04.081383Z","updated_at":"2026-11-02T15:54:01.953589Z"}]}}