CVE-2025-27788: Ruby JSON Parser has Out-of-bounds Read
First published: Wed Mar 12 2025(Updated: )
### Impact A specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions 2.10.0 and 2.10.1 are impacted. Older versions are not. ### Patches Version 2.10.2 fixes the problem. ### Workarounds None.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| rubygems/json | >=2.10.0<=2.10.1 | 2.10.2 |
| JSON Ruby | >=2.10.0<2.10.2 | |
| Ruby-lang Javascript Object Notation Ruby | >=2.10.0 <2.10.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/ruby/json/security/advisories/GHSA-9m3q-rhmv-5q44
- https://github.com/ruby/json/commit/c56db31f800d5d508389793e69682f99749dbadf
- https://github.com/ruby/json/releases/tag/v2.10.2
- https://nvd.nist.gov/vuln/detail/CVE-2025-27788
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2025-27788.yml
- https://github.com/advisories/GHSA-9m3q-rhmv-5q44 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-27788?
The severity of CVE-2025-27788 is considered to be moderate due to its potential to cause crashes.
How do I fix CVE-2025-27788?
To fix CVE-2025-27788, upgrade the Ruby JSON gem to version 2.10.2 or later.
What versions are affected by CVE-2025-27788?
CVE-2025-27788 affects Ruby JSON versions from 2.10.0 up to, but not including, 2.10.2.
What kind of vulnerabilities does CVE-2025-27788 introduce?
CVE-2025-27788 introduces an out of bounds read vulnerability that may lead to application crashes.
Is version 2.10.0 of Ruby JSON safe from CVE-2025-27788?
No, version 2.10.0 of Ruby JSON is not safe and is vulnerable to CVE-2025-27788.
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/description
- collector/nvd-cve
- source/NVD
- agent/source
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-9m3q-rhmv-5q44
- alias/CVE-2025-27788
- agent/software-canonical-lookup
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/event
- collector/github-advisory
- agent/guess-ai
- agent/software-canonical-lookup-request
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- package-manager/rubygems
- vendor/ruby
- canonical/json ruby
- vendor/ruby-lang
- canonical/ruby-lang javascript object notation ruby
- version/ruby-lang javascript object notation ruby/2.10.0