CVE-2026-54696

Received Received - Intake

Heap Buffer Overflow in Ruby JSON

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-54696

Affected Vendors & Products

Vendor	Product	Version / Range
ruby	json	From 2.9.0 (inc) to 2.19.8 (inc)
ruby	json	2.19.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability exists in Ruby JSON versions 2.9.0 through 2.19.8. It is a heap buffer overflow that occurs when the JSON generator processes an oversized streamed object containing an attacker-controlled string near 16 KB in size. Specifically, when streaming JSON data to an IO object using JSON.dump(obj, io) or JSON::State#generate(obj, io), the internal buffer can be overwritten beyond its allocated size.

This overflow can cause the process to crash reliably, leading to a denial of service condition.

The issue has been fixed in version 2.19.9.

Impact Analysis

Exploitation of this vulnerability can cause a reliable process crash, resulting in a denial of service (DoS).

This means that applications using vulnerable versions of Ruby JSON to stream large JSON objects could be interrupted or stopped by an attacker supplying specially crafted input.

Mitigation Strategies

To mitigate this vulnerability, upgrade Ruby JSON to version 2.19.9 or later, where the heap buffer overflow issue has been fixed.

Hi! I’m here to help you understand CVE-2026-54696. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70