CVE-2017-14064: Buffer Overflow
Last updated 25 August 2025
Other sources
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in spacelen.
Upstream patch:
https://github.com/flori/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85
References:
https://bugs.ruby-lang.org/issues/13853 https://hackerone.com/reports/209949
— Red Hat
Ruby. Multiple issues in Ruby were addressed in this update.
Credit
Affected Software
Remediation
Patch Available
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2018-4295
- CVE-2018-4410
- CVE-2018-4417
- CVE-2017-12613
- CVE-2017-12618
- CVE-2018-4411
- CVE-2018-4308
- CVE-2018-4468
- CVE-2018-4126
- CVE-2018-4415
- CVE-2018-4398
- CVE-2018-4412
- CVE-2018-4153
- CVE-2018-4406
- CVE-2018-4346
- CVE-2018-4403
- CVE-2018-4423
- CVE-2018-3639
- CVE-2018-4342
- CVE-2018-4304
- CVE-2018-4426
- CVE-2018-4331
- CVE-2018-3646
- CVE-2018-4242
- CVE-2018-4394
- CVE-2018-4334
- CVE-2018-4396
- CVE-2018-4418
- CVE-2018-4350
- CVE-2018-4421
- CVE-2018-4422
- CVE-2018-4408
- CVE-2018-4402
- CVE-2018-4341
- CVE-2018-4354
- CVE-2018-4401
- CVE-2018-4371
- CVE-2018-4420
- CVE-2018-4399
- CVE-2018-4340
- CVE-2018-4419
- CVE-2018-4425
- CVE-2018-4259
- CVE-2018-4286
- CVE-2018-4287
- CVE-2018-4288
- CVE-2018-4291
- CVE-2018-4413
- CVE-2018-4407
- CVE-2018-4424
- CVE-2018-4187
- CVE-2018-4348
- CVE-2018-4389
- CVE-2018-4326
- CVE-2018-4310
- CVE-2018-3640
- CVE-2018-4369
- CVE-2018-6797
- CVE-2017-0898
- CVE-2017-10784
- CVE-2017-14033
- CVE-2017-14064
- CVE-2017-17405
- CVE-2017-17742
- CVE-2018-6914
- CVE-2018-8777
- CVE-2018-8778
- CVE-2018-8779
- CVE-2018-8780
- CVE-2018-4400
- CVE-2018-4395
- CVE-2018-4393
- CVE-2018-4203
- CVE-2018-4368
- CVE-2018-4470
- CVE-2018-4289
- CVE-2018-4268
- CVE-2018-4285
- CVE-2018-5383
- CVE-2018-4293
- CVE-2018-4269
- CVE-2018-4276
- CVE-2018-4178
- CVE-2018-4456
- CVE-2018-4283
- CVE-2018-3665
- CVE-2018-4280
- CVE-2018-4248
- CVE-2018-4277
- CVE-2018-6913
- CVE-2018-4274
Frequently Asked Questions
What is CVE-2017-14064?
CVE-2017-14064 is a vulnerability in Ruby that can expose arbitrary memory during a JSON.generate call.
How severe is CVE-2017-14064?
CVE-2017-14064 has a severity rating of 9.8 out of 10, which is considered critical.
Which versions of Ruby are affected by CVE-2017-14064?
Ruby versions through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 are affected by CVE-2017-14064.
How can this vulnerability be fixed?
There is currently no known remedy for CVE-2017-14064. It is recommended to update to a fixed version of Ruby when it becomes available.
Where can I find more information about CVE-2017-14064?
More information about CVE-2017-14064 can be found at the following references: [Reference 1](https://bugs.ruby-lang.org/issues/13853), [Reference 2](https://github.com/flori/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85), [Reference 3](https://security-tracker.debian.org/tracker/CVE-2017-14064).