Out-of-bounds Read in Ruby JSON Parser

HOCH 7.5CVE-2025-27788 · GHSA-9m3q-rhmv-5q44 · Published 12/03/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
json RubyGems	`≥ 2.10.0, < 2.10.2`	`2.10.2`
javascript object notation ruby-lang	`≥ 2.10.0 , < 2.10.2`	`2.10.2`

Description

Impact

A specially crafted document could cause an out of bound read, most likely resulting in a crash.

Versions 2.10.0 and 2.10.1 are impacted. Older versions are not.

Patches

Version 2.10.2 fixes the problem.

Workarounds

None.

NVD description

JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are available.

References

ruby/json security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-27788 · ADVISORY
ruby/json commit c56db31 · WEB
ruby/json · PACKAGE
ruby/json release v2.10.2 · WEB
rubysec/ruby-advisory-db · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free