CVE-2026-54696
published 2026-06-30CVE-2026-54696: Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an…
PriorityP416low3.7CVSS 3.1
AVNACHPRNUINSUCNINAL
EPSS
0.41%
35.1th percentile
Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an
attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | backend-rhel8 | — | — |
| 3scale-amp2 | system-rhel7 | — | — |
| 3scale-amp2 | zync-rhel8 | — | — |
| clusterlabs | pcs | — | — |
| devspaces | code-rhel9 | — | — |
| joyent | json | — | — |
| joyent | json | >= 2.9.0 < 2.19.9 | 2.19.9 |
| ruby-lang | ruby | — | — |
| ruby | json | — | — |
| ruby_3.3 | ruby | — | — |
| ruby_4.0 | ruby | — | — |
| ubi10 | ruby-33 | — | — |
| ubi10 | ruby-40 | — | — |
| ubi8 | ruby-25 | — | — |
| ubi8 | ruby-33 | — | — |
| ubi9 | ruby-30 | — | — |
| ubi9 | ruby-33 | — | — |
| ubi9 | ruby-40 | — | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Ruby json: JSON generator heap buffer overflow when streaming to an IO
ghsa·2026-07-23
CVE-2026-54696 [LOW] CWE-122 Ruby json: JSON generator heap buffer overflow when streaming to an IO
Ruby json: JSON generator heap buffer overflow when streaming to an IO
### Summary
`JSON.dump(obj, io)` and `JSON::State#generate(obj, io)` can write past the
internal JSON generator buffer when a streamed object contains an
attacker-controlled string near 16 KB. The issue is a heap out-of-bounds write
in the IO-streaming path and is demonstrated as a reliable process crash /
denial of service.
This was triaged on HackerOne as report #3785370. The issue was confirmed there
and I was asked to open it here.
### Details
Root cause is in `ext/json/fbuffer/fbuffer.h`, `fbuffer_do_inc_capa()`.
On the IO path, the buffer is grown to `FBUFFER_IO_BUFFER_SIZE` (16383), but the
early return checks total capacity instead of remaining capacity:
```c
if (RB_UNLIKELY(fb->io)) {
if (fb->capa capa))
Red Hat
json: Ruby JSON: Denial of service via heap buffer overflow with oversized streamed objects
vendor_redhat·2026-06-30·CVSS 3.7
CVE-2026-54696 [LOW] CWE-787 json: Ruby JSON: Denial of service via heap buffer overflow with oversized streamed objects
json: Ruby JSON: Denial of service via heap buffer overflow with oversized streamed objects
Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an
attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.
A flaw was found in Ruby JSON. A remote attacker could exploit a heap buffer overflow vulnerability by providing an oversized streamed object containing a specially crafted string. This could lead to a
No detection rules found.
No public exploits indexed.
2026-06-30
Published