Cyber Resilience

CVE-2025-0306

High

Published: 09 January 2025

Published
09 January 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0059 69.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-0306 is a high-severity Covert Timing Channel (CWE-385) vulnerability. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-0306 is a vulnerability in the Ruby interpreter that exposes it to the Marvin Attack. Published on 2025-01-09, this issue is classified under CWE-385 and carries a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts with no availability effects.

The attack requires a remote, unauthenticated adversary to engage the vulnerable service over the network, though it demands high complexity with no user interaction needed. By exchanging a large number of messages with the service, the attacker can decrypt previously encrypted messages or forge signatures.

Mitigation guidance is provided in vendor advisories, including Red Hat security updates at https://access.redhat.com/security/cve/CVE-2025-0306 and https://bugzilla.redhat.com/show_bug.cgi?id=2336100, as well as NetApp advisory ntap-20250221-0009/ at https://security.netapp.com/advisory/ntap-20250221-0009/.

EU & UK References

Vulnerability details

A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.

CWE(s)
CWE-385

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Remote unauthenticated network exploitation of Ruby crypto flaw enabling decryption/forgery directly matches public-facing application exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-53826Shared CWE-385

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Timely identification, reporting, and correction of the flaw in the Ruby interpreter directly prevents exploitation of the Marvin Attack.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Vulnerability scanning detects systems using the vulnerable Ruby interpreter, enabling proactive remediation prior to attack.

SI-4 System Monitoring partial match
detect

System monitoring identifies anomalous large-volume message exchanges required to conduct the Marvin Attack.

References