CVE-2025-27788: Out-of-Bounds Read Vulnerability in Ruby JSON Parser
Summary
CVE-2025-27788: Out-of-bounds Read in Ruby JSON Parser. Affects json versions >= 2.10.0, < 2.10.2. Fixed in 2.10.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'json' package is a widely used Ruby library that provides functionality for parsing and generating JSON data. It is essential for applications that require data interchange in a lightweight format. However, certain versions of this package have been found to be vulnerable to an out-of-bounds read issue, which could lead to application crashes and potential data exposure.
Vulnerability Detail
The vulnerability arises from a flaw in the Ruby JSON parser that allows specially crafted JSON documents to trigger an out-of-bounds read. This can lead to unexpected behavior, including application crashes. The affected versions, 2.10.0 and 2.10.1, do not properly handle certain input, which can be exploited by attackers to cause instability in applications relying on this library.
How To Fix
Latest published version: 3.1.0 as of 23 Oct 2026
gem install json -v 3.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.10.2
This is the first release that contains the fix.
gem install json -v 2.10.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The best course of action is to update to the fixed version as soon as possible.
Conclusion
The out-of-bounds read vulnerability in the Ruby JSON parser (CVE-2025-27788) poses significant risks to applications using affected versions of the 'json' package. Immediate action is required to update to version 2.10.2 or later to mitigate potential crashes and instability.
See every vulnerability recorded for json →
FAQ
CVE-2025-27788 is a vulnerability in the Ruby JSON parser that allows for out-of-bounds reads, potentially leading to application crashes.
Versions 2.10.0 and 2.10.1 of the 'json' package are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
There are no workarounds available for this vulnerability. It is recommended to update to the patched version as soon as possible.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for json.
