Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Ruby JSON Parser may crash with malformed data

CVE-2025-27788 · published 1 year ago
Summary

The JSON library for Ruby (florian frank/json) is vulnerable in versions 2.10.0 through 2.10.1. A specially crafted JSON document can cause the program to read outside its memory area, which usually leads to a crash. Upgrade to version 2.10.2 or later to eliminate the risk; no other fixes are available.

What to do
  • Update florian frank json to version 2.10.2.
  • Update ruby-lang javascript_object_notation to version 2.10.2 or later.
Affected software
Ecosystem VendorProductAffected versions
rubygems florian frank json >= 2.10.0, <= 2.10.1
Fix: upgrade to 2.10.2
– ruby-lang javascript_object_notation >= 2.10.0 , < 2.10.2
cpe:2.3:a:ruby-lang:javascript_object_notation:*:*:*:*:*:ruby:*:*
Original advisory text
Ruby JSON Parser has Out-of-bounds Read
JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are available.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published12 Mar 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2025-27788 · OSV
GHSA-9m3q-rhmv-5q44 · GHSA
CVE-2025-27788 · NVD
Track software like this
Free during beta