CVE-2025-27788: 
Ruby vulnerability analysis and mitigation

JSON is a JSON implementation for Ruby that contains a vulnerability identified as CVE-2025-27788. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. The vulnerability was discovered and disclosed on March 12, 2025 (NVD).

The vulnerability is classified as an Out-of-bounds Read (CWE-125) with a CVSS v3.1 base score of 7.5 (HIGH). The issue occurs in the C extension parser where improper validation of input can lead to an out-of-bounds memory read. The technical root cause involves the json_string_unescape function's handling of escape sequences in the parser (GitHub Commit).

When exploited, this vulnerability results in a crash of the application processing JSON data. The CVSS metrics indicate that while there is no impact on confidentiality or integrity, there is a high impact on availability (A:H). The vulnerability can be triggered remotely without requiring any privileges or user interaction (GitHub Advisory).

The vulnerability has been fixed in version 2.10.2 of the JSON gem. No known workarounds are available, making it critical for affected users to upgrade to the patched version (GitHub Release).