Register | Log in

ruby-json

JSON library for Ruby

Choose email to subscribe with

general

source: ruby-json (main)
version: 3.1.0+dfsg-1
maintainer: Debian Ruby Team (archive) (DMD)
uploaders: Lucas Nussbaum [DMD] – Cédric Boutillier [DMD] – Lucas Kanashiro [DMD] – Utkarsh Gupta [DMD]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.3.0+dfsg-1
oldstable: 2.6.3+dfsg-1
stable: 2.9.1+dfsg-1
testing: 3.0.2+dfsg-1
unstable: 3.1.0+dfsg-1

versioned links

2.3.0+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.6.3+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.9.1+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.0.2+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.0+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

ruby-json

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In watchfile debian/watch, reading webpage
  https://api.github.com/repos/ruby/json/git/matching-refs/tags/ failed: 500 Can't connect to api.github.com:443 (Temporary failure in name resolution)

Created: 2026-10-17 Last update: 2026-10-19 12:00

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2026-71847: Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

Created: 2026-08-08 Last update: 2026-08-13 06:00

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-54696: (needs triaging) Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-07-02 Last update: 2026-10-17 05:00

testing migrations

excuses:
- Migration status for ruby-json (3.0.2+dfsg-1 to 3.1.0+dfsg-1): Waiting for test results or another package, or too young (no action required now - check later)
- Issues preventing migration:
- ∙ ∙ Autopkgtest for ruby-json/3.1.0+dfsg-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for ruby-llm/1.16.0-2: amd64: No tests, superficial or marked flaky ♻ (reference ♻), arm64: No tests, superficial or marked flaky ♻ (reference ♻), armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: Test triggered, ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), riscv64: No tests, superficial or marked flaky ♻ (reference ♻), s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Too young, only 2 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/r/ruby-json.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[2026-10-17] Accepted ruby-json 3.1.0+dfsg-1 (source) into unstable (Simon Quigley)
[2026-09-30] ruby-json 3.0.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-09-14] Accepted ruby-json 3.0.2+dfsg-1 (source) into unstable (Simon Quigley)
[2026-08-13] ruby-json 2.21.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-08-10] Accepted ruby-json 2.21.2+dfsg-1 (source) into unstable (Simon Quigley)
[2026-07-19] ruby-json 2.21.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-07-17] Accepted ruby-json 2.21.1+dfsg-1 (source) into unstable (Simon Quigley)
[2026-06-22] ruby-json 2.19.9+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-06-16] Accepted ruby-json 2.19.9+dfsg-1 (source) into unstable (Simon Quigley)
[2026-04-26] ruby-json 2.19.4+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-04-23] Accepted ruby-json 2.19.4+dfsg-1 (source) into unstable (Simon Quigley)
[2026-03-26] ruby-json 2.19.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-03-23] Accepted ruby-json 2.19.2+dfsg-1 (source) into unstable (Simon Quigley)
[2026-03-14] ruby-json 2.19.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-03-10] Accepted ruby-json 2.19.1+dfsg-1 (source) into unstable (Simon Quigley)
[2026-02-20] ruby-json 2.18.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-02-09] Accepted ruby-json 2.18.1+dfsg-1 (source) into unstable (Simon Quigley)
[2025-11-02] ruby-json 2.15.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-10-30] Accepted ruby-json 2.15.2+dfsg-1 (source) into unstable (Simon Quigley)
[2025-02-06] ruby-json 2.9.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-02-04] Accepted ruby-json 2.9.1+dfsg-1 (source) into unstable (Lucas Nussbaum)
[2025-02-01] ruby-json 2.7.6+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-01-29] Accepted ruby-json 2.7.6+dfsg-1 (source) into unstable (Lucas Nussbaum)
[2024-05-10] ruby-json 2.7.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-05-06] Accepted ruby-json 2.7.2+dfsg-1 (source) into unstable (Lucas Nussbaum)
[2022-12-29] ruby-json 2.6.3+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-12-29] ruby-json 2.6.3+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-12-26] Accepted ruby-json 2.6.3+dfsg-1 (source) into unstable (Lucas Nussbaum)
[2022-11-14] ruby-json 2.6.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-11-10] Accepted ruby-json 2.6.2+dfsg-1 (source) into unstable (Lucas Kanashiro)

1
2

bugs [bug history graph]

all: 2
RC: 0
I&N: 1
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.21.2+dfsg-1
1 bug

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing