CVE-2026-54696 Details
Description
Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.
A heap buffer overflow vulnerability has been identified in Ruby JSON versions 2.9.0 through 2.19.8. The issue arises when the JSON generator is used to stream oversized objects to an IO, specifically through the JSON.dump(obj, io) and JSON::State#generate(obj, io) methods. When a streamed object contains an attacker-controlled string close to 16 KB, the JSON generator can write beyond its internal buffer, leading to a reliable process crash and denial-of-service condition.
Users should upgrade to Ruby JSON version 2.19.9, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/ruby/json/releases/tag/v2.19.9 | [email protected] | Release NotesVendor |
| https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-131 | Incorrect Calculation of Buffer Size | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ruby JSON | >= 2.9.0, <= 2.19.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |