Skip to content
OpenAdvisories

Package · Ubuntu

ruby-json

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 8.7
    CVE-2026-71847

    Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

    Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value…

    ruby json json ruby-json Debian Ubuntu RubyGems
  • Low 3.7
    CVE-2026-54696

    Ruby JSON: JSON generator heap buffer overflow when streaming to an IO

    Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, i…

    ruby json ruby2.3 ruby2.5 Debian Ubuntu RubyGems
  • High 8.3
    CVE-2026-33210

    Ruby JSON has a format string injection vulnerability

    Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false pa…

    ruby json json ruby-json Debian Ubuntu RubyGems
  • High 7.5
    CVE-2020-10663 Public exploit

    Unsafe object creation in json RubyGem

    The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within…

    ruby2.3 ruby ruby2.5 json Debian Ubuntu Alpine RubyGems