# Unsafe Object Creation Vulnerability in JSON

**URL:** <https://discuss.elastic.co/t/unsafe-object-creation-vulnerability-in-json/243434>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [August 1, 2020, 8:10pm UTC](https://discuss.elastic.co/t/unsafe-object-creation-vulnerability-in-json/243434 "2020-08-01T20:10:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sunil\_Chadha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunil_chadha/32/44019_2.png) [@Sunil\_Chadha](https://discuss.elastic.co/u/Sunil_Chadha)\
**Post date:** [August 1, 2020, 8:10pm UTC](https://discuss.elastic.co/t/unsafe-object-creation-vulnerability-in-json/243434/1 "2020-08-01T20:10:10Z")

</div>

Hi,  
There is vulnerability reported on json version used in ruby [https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/](https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/)  
The ruby version used in latest Logstash contains this json version, which contains this vulnerability.  
Does Logstash becomes vulnerable for receiving JSON input by TCP or Beats input?

Thanks and Regards,

Sunil

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [August 1, 2020, 8:28pm UTC](https://discuss.elastic.co/t/unsafe-object-creation-vulnerability-in-json/243434/2 "2020-08-01T20:28:02Z")

</div>

Think Logstash uses jRuby and it's not effected by this CVE according to the below. But there could be some use of Ruby somewhere I suppose.

> <https://twitter.com/i/web/status/1253824129460928514>
>
> Ruby Programming Language @rubylangorg

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 29, 2020, 8:28pm UTC](https://discuss.elastic.co/t/unsafe-object-creation-vulnerability-in-json/243434/3 "2020-08-29T20:28:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.