PT-2026-54020 · Ruby · Ruby Json
CVE-2026-54696
·
Published
2026-06-30
·
Updated
2026-07-23
CVSS v3.1
3.7
Low
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Ruby JSON versions 2.9.0 through 2.19.8
Description
A heap buffer overflow occurs when the JSON generator processes an oversized streamed object. Specifically, when streaming to an IO, the
JSON.dump(obj, io) and JSON::State#generate(obj, io) functions can write past the internal buffer if a streamed object contains an attacker-controlled string near 16 KB. This can lead to a reliable process crash and denial of service.Recommendations
Update Ruby JSON to version 2.19.9.
Exploit
Fix
DoS
Heap Based Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ruby Json