Skip to content

Vendor

jruby vulnerabilities

5 published CVES affecting jruby, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
5
Critical
0
High
1
Medium
4
Low
0
Unscored
0
CISA KEV
0
Atom feed of jruby alerts

Products

Latest jruby CVEs

Newest publication first

  1. CVE-2025-46551 JRuby-OpenSSL has hostname verification disabled by default

    Published
    MediumCVSS 5.7 EPSS 0.20% PoC

    JRuby-OpenSSL is an add-on gem for JRuby that emulates the Ruby OpenSSL native library. Starting in JRuby-OpenSSL version 0.12.1 and prior to version 0.15.4 (corresponding to JRuby versions starting in 9.3.4.0 prior to 9.4.12.1 and 10.0.0.0 prior to 10.0.0.1), when verifying SSL...

  3. CVE-2012-5370 JRuby denial of service via Hash Collision

    Published
    MediumCVSS 5.0 EPSS 2.2%

    JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by...

  4. CVE-2010-1330 Cross-site Scripting in in JRuby

    Published
    MediumCVSS 4.3 EPSS 2.2%

    The regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.

  5. CVE-2011-4838 JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption...

    Published
    MediumCVSS 5.0 EPSS 4.2%

    JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.