CVE-2025-46551: JRuby OpenSSL Certificate Verification Flaw

CVE-2025-46551 Overview

CVE-2025-46551 is an Improper Certificate Validation vulnerability in JRuby-OpenSSL, an add-on gem for JRuby that emulates the Ruby OpenSSL native library. Starting in JRuby-OpenSSL version 0.12.1 and prior to version 0.15.4, the library fails to verify that the hostname presented in an SSL certificate matches the hostname the user intends to connect to. This critical flaw enables man-in-the-middle (MITM) attacks where an adversary can present any valid certificate from a domain they control, and JRuby would accept it as legitimate.

Critical Impact

Attackers can intercept and manipulate HTTPS traffic from JRuby applications by exploiting the missing hostname verification, potentially compromising sensitive data transmitted to external APIs or during web scraping operations.

Affected Products

• JRuby-OpenSSL versions 0.12.1 through 0.15.3
• JRuby versions 9.3.4.0 through 9.4.12.0
• JRuby version 10.0.0.0

Discovery Timeline

• 2025-05-07 - CVE-2025-46551 published to NVD
• 2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-46551

Vulnerability Analysis

This vulnerability is classified as CWE-295 (Improper Certificate Validation). The root issue lies in how JRuby-OpenSSL handles SSL/TLS certificate verification during secure connections. While the library performs standard certificate chain validation, it critically omits hostname verification—the check that ensures the certificate's Common Name (CN) or Subject Alternative Names (SAN) match the server the client intends to connect to.

Without hostname verification, an attacker positioned in the network path between a JRuby application and its intended destination can intercept the connection and present their own valid SSL certificate from any domain they control. Since JRuby-OpenSSL only validates that the certificate is signed by a trusted Certificate Authority but not that it belongs to the target domain, the connection would be accepted as secure.

This vulnerability affects any JRuby application that relies on HTTPS for secure communication, including applications making requests to external APIs, performing web scraping, or connecting to third-party services.

Root Cause

The root cause is the default SSL context configuration in JRuby-OpenSSL where the verify_hostname parameter was explicitly set to nil (disabled) instead of true. This configuration choice meant that even when certificate verification mode was set to VERIFY_PEER, the critical hostname check was bypassed. The code comment in the original implementation noted this as a TODO item, indicating it was a known gap awaiting JRuby support for the verify_certificate_identity function.

Attack Vector

The vulnerability is exploitable via network-based man-in-the-middle attacks. An attacker must be able to intercept network traffic between a vulnerable JRuby application and its intended HTTPS destination. This can occur through:

1. Compromised network infrastructure (routers, switches)
2. ARP spoofing on local networks
3. DNS poisoning attacks
4. Rogue Wi-Fi access points
5. BGP hijacking at the ISP level

Once positioned, the attacker establishes a TLS connection with the JRuby client using a certificate for a domain they legitimately control. Since hostname verification is disabled, JRuby accepts this certificate despite the domain mismatch, allowing the attacker to decrypt, inspect, and modify traffic before forwarding it to the actual destination.

# Security patch from lib/openssl/ssl.rb
# Source: https://github.com/jruby/jruby-openssl/commit/31a56d690ce9b8af47af09aaaf809081949ed285

       DEFAULT_PARAMS = { # :nodoc:
         :min_version => OpenSSL::SSL::TLS1_VERSION,
         :verify_mode => OpenSSL::SSL::VERIFY_PEER,
-        :verify_hostname => nil, # TODO => true needs JRuby support to call verify_certificate_identity
+        :verify_hostname => true,
         :options => OpenSSL::SSL::OP_ALL | OpenSSL::SSL::OP_NO_COMPRESSION
       }

Source: GitHub Commit 31a56d6

Detection Methods for CVE-2025-46551

Indicators of Compromise

• Unexpected SSL/TLS certificate warnings or errors in application logs that were subsequently ignored
• Network traffic showing connections to IP addresses that don't match expected destination hosts
• Certificate chain validations succeeding for connections where the certificate subject doesn't match the target hostname
• Unusual data exfiltration patterns from JRuby applications making external HTTPS requests

Detection Strategies

• Audit JRuby application dependencies using gem list jruby-openssl to identify vulnerable versions below 0.15.4
• Review network traffic logs for TLS handshakes where the Server Name Indication (SNI) doesn't match the certificate subject
• Implement certificate transparency monitoring for domains your JRuby applications connect to
• Deploy network intrusion detection rules to flag certificate-hostname mismatches in TLS sessions

Monitoring Recommendations

• Enable verbose SSL/TLS logging in JRuby applications to capture certificate details during connections
• Monitor for ARP spoofing and DNS poisoning attempts on networks where JRuby applications operate
• Implement continuous dependency scanning in CI/CD pipelines to detect vulnerable JRuby-OpenSSL versions
• Set up alerts for outbound HTTPS connections from JRuby services that fail certificate hostname checks after patching

How to Mitigate CVE-2025-46551

Immediate Actions Required

• Upgrade JRuby-OpenSSL to version 0.15.4 or later immediately
• Update JRuby to version 9.4.12.1 or 10.0.0.1 which include the patched JRuby-OpenSSL
• Audit all JRuby applications making outbound HTTPS connections to identify potentially affected services
• Review logs for any suspicious network activity during the exposure window

Patch Information

The vulnerability has been addressed in JRuby-OpenSSL version 0.15.4. The fix changes the default verify_hostname parameter from nil to true in the DEFAULT_PARAMS configuration, ensuring hostname verification is enabled by default for all SSL connections. This fix is bundled in JRuby versions 9.4.12.1 and 10.0.0.1. For detailed information, see the GitHub Security Advisory GHSA-72qj-48g4-5xgx.

Workarounds

• If immediate upgrade is not possible, explicitly set verify_hostname: true in SSL context configurations within your application code
• Implement certificate pinning for critical external API connections to prevent MITM attacks regardless of hostname verification status
• Route JRuby application traffic through a trusted proxy that performs proper TLS verification
• Isolate vulnerable JRuby applications on network segments with strict egress controls until patching is complete

# Update JRuby-OpenSSL gem to patched version
gem update jruby-openssl --version '>= 0.15.4'

# Alternatively, update JRuby to a patched version
# For JRuby 9.x series:
sdk install jruby 9.4.12.1

# For JRuby 10.x series:
sdk install jruby 10.0.0.1

# Verify installed version
jruby -S gem list jruby-openssl