CVE-2025-27788

JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are available.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27788.json"
}

References

Affected packages

Git / github.com/ruby/json

Affected ranges

Type

GIT

Repo

https://github.com/ruby/json

Events

Introduced

8b56d472549c76d6599550656a4a7e87baf3d2ef

Fixed

350c1fd154eaf7840f696c623362478a9148166c

Fixed

c56db31f800d5d508389793e69682f99749dbadf

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:ruby-lang:javascript_object_notation:*:*:*:*:*:ruby:*:*",
            "range":  [
                {
                    "introduced":  "2.10.0 "
                },
                {
                    "fixed":  "2.10.2"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "c56db31f800d5d508389793e69682f99749dbadf"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v2.10.2",
            "range":  [
                {
                    "fixed":  "350c1fd154eaf7840f696c623362478a9148166c"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2.*

v2.10.0

v2.10.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27788.json"