CVE-2026-54696

Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/ruby/json/releases/tag/v2.19.9
https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687
https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687

Configurations

No configuration.

History

01 Jul 2026, 14:16

Type	Values Removed	Values Added
References	~~() https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687 -~~	() https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687 -

30 Jun 2026, 23:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-30 23:17

Updated : 2026-07-02 17:54

NVD link : CVE-2026-54696

Mitre link : CVE-2026-54696

CVE.ORG link : CVE-2026-54696

JSON object : View

Products Affected

No product.

CWE

CWE-122

Heap-based Buffer Overflow

CWE-131

Incorrect Calculation of Buffer Size

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-54696", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54696", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T13:20:35.390078Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ruby", "product": "json", "versions": [{"status": "affected", "version": ">= 2.9.0, < 2.19.9"}]}]}], "published": "2026-06-30T23:17:28.123", "references": [{"url": "https://github.com/ruby/json/releases/tag/v2.19.9", "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687", "source": "security-advisories@github.com"}, {"url": "https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-131"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an\nattacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9."}], "lastModified": "2026-07-02T17:54:15.243", "sourceIdentifier": "security-advisories@github.com"}