CVE-2025-66453: Mozilla Rhino DOS Vulnerability

CVE-2025-66453 Overview

CVE-2025-66453 is a denial of service vulnerability in Mozilla Rhino, an open-source implementation of JavaScript written entirely in Java. The flaw exists in the toFixed() function of the NativeNumber class. When an application passes an attacker-controlled floating point number to toFixed(), the engine attempts to compute an unreasonably large power of five, leading to high CPU consumption. The issue is tracked as [CWE-400] Uncontrolled Resource Consumption and affects Rhino versions prior to 1.8.1, 1.7.15.1, and 1.7.14.1.

Critical Impact
Attackers who supply crafted floating point values to applications embedding Rhino can trigger sustained CPU exhaustion, resulting in denial of service for the host application.

Affected Products

Mozilla Rhino versions prior to 1.7.14.1
Mozilla Rhino 1.7.15 (fixed in 1.7.15.1)
Mozilla Rhino 1.8.0 (fixed in 1.8.1)

Discovery Timeline

2025-12-03 - CVE-2025-66453 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66453

Vulnerability Analysis

Rhino embeds a JavaScript runtime inside Java applications. The Number.prototype.toFixed() method formats a number using fixed-point notation. In vulnerable releases, calling toFixed() with certain small floating point values drives the internal number-to-string conversion path into an expensive arbitrary-precision arithmetic routine. The thread executing the script becomes CPU-bound and unresponsive, degrading or halting the host application.

This vulnerability is exploitable over the network in scenarios where user-supplied JavaScript, JSON, or numeric input reaches a Rhino evaluation context. The attack requires no authentication and no user interaction. Only availability is impacted; there is no confidentiality or integrity loss.

Root Cause

The defect is located in the number formatting call chain: NativeNumber.numTo invokes DToA.JS_dtostr, which calls DToA.JS_dtoa, which in turn invokes DToA.pow5mult. The pow5mult routine attempts to raise 5 to an excessively large power when it receives extreme small-value inputs. The routine lacks bounds checking on the exponent, allowing the multiplication loop to consume unbounded CPU time and memory during big-integer expansion.

Attack Vector

An attacker submits a crafted floating point literal to any application surface that eventually calls toFixed() on attacker-controlled input inside the Rhino engine. Common exposure paths include server-side JavaScript execution, template engines, rules engines, and scripting extensions in Java-based platforms. A single crafted request can pin a worker thread, and repeated requests can exhaust the thread pool.

No verified public exploit code is available. The vulnerability is described in the Mozilla Rhino GitHub Security Advisory.

Detection Methods for CVE-2025-66453

Indicators of Compromise

Sustained 100% CPU utilization on a single JVM thread executing Rhino script evaluation
Application request timeouts correlated with JavaScript numeric input containing extreme floating point values
Thread dumps showing threads blocked inside org.mozilla.javascript.DToA.pow5mult or DToA.JS_dtoa

Detection Strategies

Inventory Java applications and dependencies for rhino JARs at versions below 1.8.1, 1.7.15.1, or 1.7.14.1 using software composition analysis
Capture periodic JVM thread dumps and alert on stack frames referencing DToA.pow5mult or NativeNumber.numTo
Inspect application logs for repeated script execution timeouts originating from a single client or IP range

Monitoring Recommendations

Track CPU consumption per JVM worker thread and generate alerts on sustained high utilization tied to script execution contexts
Log and sample floating point inputs submitted to any endpoint that forwards data into a Rhino context
Correlate web application firewall telemetry with backend thread contention events to identify probing behavior

How to Mitigate CVE-2025-66453

Immediate Actions Required

Upgrade Rhino to version 1.8.1, 1.7.15.1, or 1.7.14.1 depending on the branch in use
Identify transitive dependencies that bundle Rhino and coordinate upstream updates where direct upgrade is not possible
Apply script execution timeouts and thread-level CPU quotas in embedding applications to bound abuse of any remaining code paths

Patch Information

Mozilla published fixes in Rhino 1.8.1, 1.7.15.1, and 1.7.14.1. The corrected code paths prevent pow5mult from attempting excessive exponentiation during toFixed() conversion. Details are available in the Mozilla Rhino GitHub Security Advisory GHSA-3w8q-xq97-5j7x.

Workarounds

Validate and reject numeric input with extreme magnitudes before passing it to script contexts
Wrap Rhino script evaluation in a Context with setInstructionObserverThreshold() to interrupt long-running scripts
Isolate Rhino execution in a bounded thread pool with strict execution timeouts to contain resource exhaustion

bash

# Configuration example: Maven dependency upgrade
<dependency>
  <groupId>org.mozilla</groupId>
  <artifactId>rhino</artifactId>
  <version>1.8.1</version>
</dependency>