CVE-2020-10663

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

• CWE-20

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00004.htmlMailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2020/Dec/32Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae%40%3Cdev.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c%40%3Cissues.zookeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2020/04/msg00030.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QL6MJD2BO4IRJ5CJFNMCDYMQQFT24BJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NK2PBXWMFRUD7U7Q7LHV4KYLYID77RI4/
• https://security.netapp.com/advisory/ntap-20210129-0003/Third Party Advisory
• https://support.apple.com/kb/HT211931Third Party Advisory
• https://www.debian.org/security/2020/dsa-4721Third Party Advisory
• https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00004.htmlMailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2020/Dec/32Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae%40%3Cdev.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c%40%3Cissues.zookeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2020/04/msg00030.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QL6MJD2BO4IRJ5CJFNMCDYMQQFT24BJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4TNVTT66VPRMX5UZYSDGSVRXKKDDDU5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NK2PBXWMFRUD7U7Q7LHV4KYLYID77RI4/
• https://security.netapp.com/advisory/ntap-20210129-0003/Third Party Advisory
• https://support.apple.com/kb/HT211931Third Party Advisory
• https://www.debian.org/security/2020/dsa-4721Third Party Advisory
• https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/Vendor Advisory

Published

Apr 28, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10657The Proofpoint Insider Threat Management Server (formerly Ob…7.2
• CVE-2020-10658The Proofpoint Insider Threat Management Server (formerly Ob…9.8
• CVE-2020-10659Entrust Entelligence Security Provider (ESP) before 10.0.60 …4.3
• CVE-2020-1066An elevation of privilege vulnerability exists in .NET Frame…7.8
• CVE-2020-10660HashiCorp Vault and Vault Enterprise versions 0.9.0 through …5.3
• CVE-2020-10661HashiCorp Vault and Vault Enterprise versions 0.11.0 through…9.1
• CVE-2020-10664The IGMP component in VxWorks 6.8.3 IPNET CVE patches create…7.5
• CVE-2020-10665Docker Desktop allows local privilege escalation to NT AUTHO…6.7
• CVE-2020-10666The restapps (aka Rest Phone apps) module for Sangoma FreePB…9.8
• CVE-2020-10667The web application exposed by the Canon Oce Colorwave 500 4…6.1
• CVE-2020-10668The web application exposed by the Canon Oce Colorwave 500 4…6.1
• CVE-2020-10669The web application exposed by the Canon Oce Colorwave 500 4…7.5