CVE-2025-46551

JRuby-OpenSSL is an add-on gem for JRuby that emulates the Ruby OpenSSL native library. Starting in JRuby-OpenSSL version 0.12.1 and prior to version 0.15.4 (corresponding to JRuby versions starting in 9.3.4.0 prior to 9.4.12.1 and 10.0.0.0 prior to 10.0.0.1), when verifying SSL certificates, JRuby-OpenSSL does not verify that the hostname presented in the certificate matches the one the user tries to connect to. This means a man-in-the-middle could just present any valid cert for a completely different domain they own, and JRuby would accept the cert. Anybody using JRuby to make requests of external APIs, or scraping the web, that depends on https to connect securely. JRuby-OpenSSL version 0.15.4 contains a fix for the issue. This fix is included in JRuby versions 10.0.0.1 and 9.4.12.1.

• CWE-295

• https://github.com/jruby/jruby-openssl/commit/31a56d690ce9b8af47af09aaaf809081949ed285Patch
• https://github.com/jruby/jruby-openssl/security/advisories/GHSA-72qj-48g4-5xgxExploit, Vendor Advisory
• https://github.com/jruby/jruby-openssl/security/advisories/GHSA-72qj-48g4-5xgxExploit, Vendor Advisory

Published

May 7, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46546In Sherpa Orchestrator 141851, multiple time-based blind SQL…8.8
• CVE-2025-46547In Sherpa Orchestrator 141851, the web application lacks pro…6.1
• CVE-2025-46548If you enable Basic Authentication in Pekko Management using…6.5
• CVE-2025-46549YesWiki is a wiki system written in PHP. Prior to version 4.…6.1
• CVE-2025-4655SSRF vulnerability in FreeMarker templates in Liferay Portal…5
• CVE-2025-46550YesWiki is a wiki system written in PHP. Prior to version 4.…6.1
• CVE-2025-46552KHC-INVITATION-AUTOMATION is a GitHub automation script that…6.3
• CVE-2025-46553@misskey-dev/summaly is a tool for getting a summary of a we…6.1
• CVE-2025-46554XWiki is a generic wiki platform. In versions starting from …5.3
• CVE-2025-46556Mantis Bug Tracker (MantisBT) is an open source issue tracke…7.5
• CVE-2025-46557XWiki is a generic wiki platform. In versions starting from …9.8
• CVE-2025-46558XWiki Contrib's Syntax Markdown allows importing Markdown co…9