Vulnerability · Published Mar 12, 2025 · Assigned by GitHub_M
CVE-2025-27788Ruby JSON Parser has Out-of-bounds Read
High 7.5
In plain English
A high-severity out-of-bounds read in json from ruby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 45.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are available.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | json | 2.10.2 | GHSA-9m3q-rhmv-5q44 |
| Ubuntu:22.04:LTS | ruby-json | no fix listed | UBUNTU-CVE-2025-27788 |
| Ubuntu:24.04:LTS | ruby-json | no fix listed | UBUNTU-CVE-2025-27788 |
Affected products (as reported)
Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/ruby/json/security/advisories/GHSA-9m3q-rhmv-5q44 x_refsource_CONFIRM
- https://github.com/ruby/json/commit/c56db31f800d5d508389793e69682f99749dbadf x_refsource_MISC
- https://github.com/ruby/json/releases/tag/v2.10.2 x_refsource_MISC