cve.bz

CVE-2025-27788

7.5 highEPSS 0.7%

High (7.5) in ruby-lang javascript object notation. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in json 2.10.2.

JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are available.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE
CWE-125
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-9m3q-rhmv-5q44RubyGemsjson>=2.10.0 <2.10.22.10.2

References

Check your stackJSON