CVE-2026-54696

Name of the Vulnerable Software and Affected Versions Ruby JSON versions 2.9.0 through 2.19.8

Description A heap buffer overflow occurs when the JSON generator processes an oversized streamed object. Specifically, when streaming to an IO, the JSON.dump(obj, io) and JSON::State#generate(obj, io) functions can write past the internal buffer if a streamed object contains an attacker-controlled string near 16 KB. This can lead to a reliable process crash and denial of service.

Recommendations Update Ruby JSON to version 2.19.9.