The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through…
Priority MEDIUM 43CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 12 fixed, 8 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
Why it matters now
EPSS 0.06811 94th percentileScored 2026-11-07
Fix Partial json (RubyGems): 2.3.0Red Hat: 9 advisoriesRed Hat: 12 fixed, 8 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | json (RubyGems) | before 2.3.0 | 2.3.0 | Patch available | GHSA-jphg-qwrw-7w9g |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- json (RubyGems) Vendor— Affected before 2.3.0 Fixed in 2.3.0 Patch available GHSA-jphg-qwrw-7w9g
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:json_project:json:*:*:*:*:*:ruby:*:* | up to 2.2.0 | Vulnerable | Json Project |
| cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* | 2.4.0 – 2.4.9; 2.5.0 – 2.5.7; 2.6.0 – 2.6.5 | Running on | ruby |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:apple:macos:11.0.1:*:*:*:*:*:*:* | 11.0.1 | Vulnerable | Apple |
- cpe:2.3:a:json_project:json:*:*:*:*:*:ruby:*:* Versions up to 2.2.0 Vulnerable ·Json Project
- cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* Versions 2.4.0 – 2.4.9; 2.5.0 – 2.5.7; 2.6.0 – 2.6.5 Running on ·ruby
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:apple:macos:11.0.1:*:*:*:*:*:*:* Versions 11.0.1 Vulnerable ·Apple
Remediation
- Fix · GHSA-jphg-qwrw-7w9g json (RubyGems) Fixed in 2.3.0 Advisory →
Red Hat 9 advisories
- RHSA-2022:0582 Released 2022-02-21 · Red Hat rating Importantruby:2.6 security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) ruby-2.6.9-107.module+el8.2.0+14086+86d863af.aarch64::ruby:2.6, ruby-2.6.9-107.module+el8.2.0+14086+86d863af.i686::ruby:2.6, ruby-2.6.9-107.module+el8.2.0+14086+86d863af.ppc64le::ruby:2.6 +47
- RHSA-2022:0581 Released 2022-02-21 · Red Hat rating Importantruby:2.6 security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.1) ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.i686::ruby:2.6, ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.ppc64le::ruby:2.6, ruby-2.6.9-107.module+el8.1.0+14088+04cf326e.src::ruby:2.6 +47
- RHSA-2021:2587 Released 2021-06-29 · Red Hat rating Moderateruby:2.5 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) ruby-2.5.9-107.module+el8.4.0+10822+fe4fffb1.aarch64::ruby:2.5, ruby-2.5.9-107.module+el8.4.0+10822+fe4fffb1.i686::ruby:2.5, ruby-2.5.9-107.module+el8.4.0+10822+fe4fffb1.ppc64le::ruby:2.5 +47
Show 6 more Red Hat advisories
- RHSA-2021:2588 Released 2021-06-29 · Red Hat rating Moderateruby:2.6 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) ruby-2.6.7-107.module+el8.4.0+10830+bbd85cce.aarch64::ruby:2.6, ruby-2.6.7-107.module+el8.4.0+10830+bbd85cce.i686::ruby:2.6, ruby-2.6.7-107.module+el8.4.0+10830+bbd85cce.ppc64le::ruby:2.6 +47
- RHSA-2021:2230 Released 2021-06-03 · Red Hat rating Moderaterh-ruby26-ruby security, bug fix, and enhancement update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ruby26-ruby-2.6.7-119.el7, rh-ruby26-ruby-devel-2.6.7-119.el7, rh-ruby26-ruby-doc-2.6.7-119.el7 +18
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-ruby26-ruby-2.6.7-119.el7, rh-ruby26-ruby-devel-2.6.7-119.el7, rh-ruby26-ruby-doc-2.6.7-119.el7 +18
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ruby26-ruby-2.6.7-119.el7, rh-ruby26-ruby-devel-2.6.7-119.el7, rh-ruby26-ruby-doc-2.6.7-119.el7 +18
- RHSA-2021:2104 Released 2021-05-26 · Red Hat rating Moderaterh-ruby25-ruby security, bug fix, and enhancement update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ruby25-ruby-2.5.9-9.el7, rh-ruby25-ruby-devel-2.5.9-9.el7, rh-ruby25-ruby-doc-2.5.9-9.el7 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-ruby25-ruby-2.5.9-9.el7, rh-ruby25-ruby-devel-2.5.9-9.el7, rh-ruby25-ruby-doc-2.5.9-9.el7 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-ruby25-ruby-2.5.9-9.el7, rh-ruby25-ruby-devel-2.5.9-9.el7, rh-ruby25-ruby-doc-2.5.9-9.el7 +17
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ruby25-ruby-2.5.9-9.el7, rh-ruby25-ruby-devel-2.5.9-9.el7, rh-ruby25-ruby-doc-2.5.9-9.el7 +17
- RHSA-2020:2670 Released 2020-06-23 · Red Hat rating Moderatepcs security and bug fix update
- Red Hat Enterprise Linux High Availability EUS (v. 8.1) pcs-0.10.2-4.el8_1.1, pcs-snmp-0.10.2-4.el8_1.1
- Red Hat Enterprise Linux Resilient Storage EUS (v. 8.1) pcs-0.10.2-4.el8_1.1, pcs-snmp-0.10.2-4.el8_1.1
- RHSA-2020:2462 Released 2020-06-10 · Red Hat rating Moderatepcs security and bug fix update
- Red Hat Enterprise Linux High Availability (v. 8) pcs-0.10.4-6.el8_2.1, pcs-snmp-0.10.4-6.el8_2.1
- Red Hat Enterprise Linux Resilient Storage (v. 8) pcs-0.10.4-6.el8_2.1, pcs-snmp-0.10.4-6.el8_2.1
- RHSA-2020:2473 Released 2020-06-10 · Red Hat rating Moderatepcs security and bug fix update
- Red Hat Enterprise Linux High Availability E4S (v. 8.0) pcs-0.10.1-4.el8_0.5, pcs-snmp-0.10.1-4.el8_0.5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| CloudForms Management Engine 5 | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix planned: Out of support scope |
| Red Hat Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat Update Infrastructure 3 for Cloud Providers | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:2587, RHSA-2021:2588 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.1) | Fixed | RHSA-2022:0581 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.2) | Fixed | RHSA-2022:0582 |
| Red Hat Enterprise Linux High Availability (v. 8) | Fixed | RHSA-2020:2462 |
| Red Hat Enterprise Linux High Availability E4S (v. 8.0) | Fixed | RHSA-2020:2473 |
| Red Hat Enterprise Linux High Availability EUS (v. 8.1) | Fixed | RHSA-2020:2670 |
| Red Hat Enterprise Linux Resilient Storage (v. 8) | Fixed | RHSA-2020:2462 |
| Red Hat Enterprise Linux Resilient Storage EUS (v. 8.1) | Fixed | RHSA-2020:2670 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:2104, RHSA-2021:2230 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2021:2104 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2021:2104, RHSA-2021:2230 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:2104, RHSA-2021:2230 |
Not affected: 8 products
- CloudForms Management Engine 5
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Fuse 7
- Red Hat JBoss A-MQ 6
- Red Hat JBoss Fuse 6
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2020-10663
- 2026-10-03 Alias added: GHSA-jphg-qwrw-7w9g
References
Advisory 11
- https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
- [debian-lts-announce] 20200430 [SECURITY] [DLA 2192-1] ruby2.1 security update
- openSUSE-SU-2020:0586
- FEDORA-2020-26df92331a
- FEDORA-2020-d171bf636d
- FEDORA-2020-a95706b117
- DSA-4721
- https://support.apple.com/kb/HT211931
- 20201215 APPLE-SA-2020-12-14-4 Additional information for APPLE-SA-2020-11-13-1 macOS Big Sur 11.0.1
- https://security.netapp.com/advisory/ntap-20210129-0003/
- https://nvd.nist.gov/vuln/detail/CVE-2020-10663
Other 26
- [zookeeper-dev] 20200913 [jira] [Created] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712
- [zookeeper-issues] 20200913 [jira] [Created] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712
- [zookeeper-issues] 20200913 [jira] [Resolved] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712
- [zookeeper-issues] 20200930 [jira] [Comment Edited] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712
- [zookeeper-issues] 20200930 [jira] [Commented] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712
- [zookeeper-issues] 20200930 [jira] [Issue Comment Deleted] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712
- [zookeeper-issues] 20210106 [jira] [Updated] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712
- [zookeeper-issues] 20210404 [jira] [Updated] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712
- [zookeeper-issues] 20210404 [jira] [Assigned] (ZOOKEEPER-3933) owasp failing with json-simple-1.1.1.jar: CVE-2020-10663, CVE-2020-7712
- https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663
- https://security.netapp.com/advisory/ntap-20210129-0003
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NK2PBXWMFRUD7U7Q7LHV4KYLYID77RI4
- https://lists.fedoraproject.org/archives/list/[email protected]/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7QL6MJD2BO4IRJ5CJFNMCDYMQQFT24BJ
- https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae@%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b@%3Cissues.zookeeper.apache.org%3E
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2020-10663.yml
- https://github.com/flori/json/blob/master/CHANGES.md#2019-12-11-230
- https://github.com/flori/json
Sources
- CVE-2020-10663 · CVE Program
- CVE-2020-10663 · NVD
- FIRST EPSS
- GHSA-jphg-qwrw-7w9g · GitHub Advisory Database · CC BY 4.0
- CVE-2020-10663 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences