CVE-2026-54696

Deferred Deferred - Pending Action

Heap Buffer Overflow in Ruby JSON

Publication date: 2026-06-30

Last updated on: 2026-07-01

Assigner: GitHub, Inc.

Description

Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-07-01

Generated

2026-07-21

AI Q&A

2026-07-01

EPSS Evaluated

2026-07-19

NVD

CVE-2026-54696

Affected Vendors & Products

Vendor	Product	Version / Range
ruby	json	From 2.9.0 (inc) to 2.19.8 (inc)
ruby	json	2.19.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Ruby JSON versions 2.9.0 through 2.19.8. It is a heap buffer overflow that occurs when the JSON generator processes an oversized streamed object containing an attacker-controlled string near 16 KB in size. Specifically, when streaming JSON data to an IO object using JSON.dump(obj, io) or JSON::State#generate(obj, io), the internal buffer can be overwritten beyond its allocated size.

This overflow can cause the process to crash reliably, leading to a denial of service condition.

The issue has been fixed in version 2.19.9.

Detection Guidance

This vulnerability can be detected by identifying if your system is running a vulnerable version of the Ruby JSON gem, specifically versions from 2.9.0 through 2.19.8.

To detect the presence of the vulnerable Ruby JSON gem version, you can run the following command to check the installed gem version:

gem list json

If the version is between 2.9.0 and 2.19.8 inclusive, your system is vulnerable.

Additionally, you can check your application code or logs for usage of JSON.dump(obj, io) or JSON::State#generate(obj, io) methods that stream JSON data to IO objects, as these are the vulnerable code paths.

There are no specific network detection commands or signatures mentioned for this vulnerability, as it is a local code execution issue triggered by crafted input strings near 16 KB in size.

Impact Analysis

Exploitation of this vulnerability can cause a reliable process crash, resulting in a denial of service (DoS).

This means that applications using vulnerable versions of Ruby JSON to stream large JSON objects could be interrupted or stopped by an attacker supplying specially crafted input.

Compliance Impact

The vulnerability causes a heap buffer overflow that can lead to a process crash or denial of service, but it does not impact confidentiality, integrity, or data exposure directly.

Since the vulnerability does not result in unauthorized data access or modification, it is unlikely to directly affect compliance with standards such as GDPR or HIPAA, which focus on protecting personal and sensitive data.

However, denial of service could indirectly affect availability requirements under these regulations if critical services are disrupted.

Mitigation Strategies

To mitigate this vulnerability, upgrade Ruby JSON to version 2.19.9 or later, where the heap buffer overflow issue has been fixed.

Hi! I’m here to help you understand CVE-2026-54696. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70