Skip to content

Product

org.jruby/jruby vulnerabilities

2 published CVES affecting org.jruby/jruby, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest org.jruby/jruby CVEs

Newest publication first

  1. CVE-2025-46551 JRuby-OpenSSL has hostname verification disabled by default

    Published
    MediumCVSS 5.7 PoC

    Summary When verifying SSL certificates, jruby-openssl is not verifying that the hostname presented in the certificate matches the one we are trying to connect to, meaning a MITM could just present any valid cert for a completely different domain they own, and JRuby wouldn't comp...

  2. CVE-2013-1821 Ruby vulnerable to denial of service

    Published
    MediumCVSS 5.0

    lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.