CVE-2025-27788 Ruby JSON Parser has Out-of-bounds Read
A specially crafted JSON document can cause an out-of-bounds read and crash the application using the Ruby JSON library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-27788?
CVE-2025-27788 is a high-severity denial of service vulnerability in ruby json, published on 12 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are available.
Weakness: CWE-125
Which versions are affected by CVE-2025-27788?
2 open source packages ship an affected version, including json. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
json RubyGems | From 2.10.0 | 2.10.2 |
json RubyGems | From 2.10.0 | 2.10.2 |
Products include Ruby-Lang Javascript Object Notation.
How do I fix CVE-2025-27788?
Upgrade json to 2.10.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-27788 being exploited?
There is no known exploitation of CVE-2025-27788 in the wild and no public exploit code.
Sources
Also known as GHSA-9m3q-rhmv-5q44, MINI-9fr2-mqjm-5v6r.