GHSA-9m3q-rhmv-5q44

Out-of-bounds Read in Ruby JSON Parser

Source: GitHub Advisory Database (reviewed) High CVE-2025-27788

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	json	>= 2.10.0, < 2.10.2	2.10.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions 2.10.0 and 2.10.1 are impacted. Older versions are not. ### Patches Version 2.10.2 fixes the problem. ### Workarounds None.

References

External links from the advisory. They lead to third-party sites.

https://github.com/ruby/json/security/advisories/GHSA-9m3q-rhmv-5q44 web
https://nvd.nist.gov/vuln/detail/CVE-2025-27788 advisory
https://github.com/ruby/json/commit/c56db31f800d5d508389793e69682f99749dbadf web
https://github.com/ruby/json package
https://github.com/ruby/json/releases/tag/v2.10.2 web
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2025-27788.yml web