The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ruby-json | Jul 30, 2024 | Feb 13, 2013 |
| Freebsd | — | Upgrade rubygem19-json_pureUpgrade rubygem18-jsonUpgrade rubygem19-jsonUpgrade rubyUpgrade rubygem18-json_pure | Dec 10, 2025 | Feb 16, 2013 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | Feb 12, 2013 |
| Suse | — | Upgrade sle-sdk-releaseUpgrade ruby19-devel-extraUpgrade ruby-test-suiteUpgrade ruby-examplesUpgrade ruby-doc-riUpgrade ruby19-doc-riUpgrade ruby-tkUpgrade ruby-commonUpgrade ruby-develUpgrade ruby19Upgrade rubygem-json_pureUpgrade ruby19-develUpgrade ruby-tk-debuginfoUpgrade ruby-debuginfoUpgrade ruby19-tkUpgrade ruby-doc-htmlUpgrade ruby-debugsourceUpgrade ruby | Feb 17, 2015 | Feb 12, 2013 |
| Ubuntu | — | Upgrade ruby1.9.1Upgrade libruby1.9.1 | Nov 8, 2024 | Feb 13, 2013 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub