CVE-2025-27788: Ruby JSON Parser has Out-of-bounds Read
Impact
A specially crafted document could cause an out of bound read, most likely resulting in a crash.
Versions 2.10.0 and 2.10.1 are impacted. Older versions are not.
Patches
Version 2.10.2 fixes the problem.
Workarounds
None.
Other sources
JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are available.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27788?
The severity of CVE-2025-27788 is considered to be moderate due to its potential to cause crashes.
How do I fix CVE-2025-27788?
To fix CVE-2025-27788, upgrade the Ruby JSON gem to version 2.10.2 or later.
What versions are affected by CVE-2025-27788?
CVE-2025-27788 affects Ruby JSON versions from 2.10.0 up to, but not including, 2.10.2.
What kind of vulnerabilities does CVE-2025-27788 introduce?
CVE-2025-27788 introduces an out of bounds read vulnerability that may lead to application crashes.
Is version 2.10.0 of Ruby JSON safe from CVE-2025-27788?
No, version 2.10.0 of Ruby JSON is not safe and is vulnerable to CVE-2025-27788.