Heap Buffer Overflow in Ruby JSON Affects Multiple Versions
CVE-2026-54696

3.7LOW

Key Information:

Vendor

Ruby

Status
Json
Vendor
CVE Published:
30 June 2026

What is CVE-2026-54696?

The Ruby JSON library is susceptible to a heap buffer overflow that occurs when oversized streamed objects are processed. Specifically, when the JSON generator is tasked with handling an attacker-controlled string close to 16 KB, it can exceed the bounds of its internal buffer while executing methods like JSON.dump(obj, io) and JSON::State#generate(obj, io). This vulnerability can lead to a denial of service, as exploiting it causes the process to crash. Users are strongly advised to upgrade to version 2.19.9, where this issue has been addressed.

Affected Version(s)

json >= 2.9.0, < 2.19.9

References

https://github.com/ruby/json/security/advisories/GHSA-x2f...
x_refsource_CONFIRM
https://github.com/ruby/json/releases/tag/v2.19.9
x_refsource_MISC

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.