Ruby json: JSON generator heap buffer overflow when streaming to an IO

🗓️ 23 Jul 2026 19:48:08Reported by GitHub Advisory DatabaseType

JSON.dump and JSON::State#generate can overflow the IO buffer when streaming long attacker strings.

Reporter	Title	Published	Views	Family All 20
ATTACKERKB	CVE-2026-54696	30 Jun 202622:05	–	attackerkb
Chainguard	CVE-2026-54696 vulnerabilities	24 Jul 202620:25	–	cgr
Circl	CVE-2026-54696	6 Jul 202608:45	–	circl
CVE	CVE-2026-54696	30 Jun 202622:05	–	cve
Cvelist	CVE-2026-54696 Ruby JSON: JSON generator heap buffer overflow when streaming to an IO	30 Jun 202622:05	–	cvelist
Debian CVE	CVE-2026-54696	30 Jun 202622:05	–	debiancve
EUVD	EUVD-2026-40626	23 Jul 202619:48	–	euvd
NVD	CVE-2026-54696	30 Jun 202623:17	–	nvd
OSV	CLEANSTART-2026-UT74115 Security fixes for CVE-2026-33637, CVE-2026-41316, CVE-2026-42245, CVE-2026-42246, CVE-2026-42256, CVE-2026-42257, CVE-2026-42258, CVE-2026-54171, CVE-2026-54297, CVE-2026-54696, CVE-2026-54904, CVE-2026-54905, CVE-2026-54906, ghsa-5rv5-xj5j-3484, ghsa-6wx8-w4f5-wwcr, ghsa-75xq-5h9v-w6px, ghsa-87pf-fpwv-p7m7, ghsa-98m9-hrrm-r99r, ghsa-h8w8-99g7-qmvj, ghsa-hm49-wcqc-g2xg, ghsa-q2mw-fvj9-vvcw, ghsa-vcgp-9326-pqcp, ghsa-wv3x-4vxv-whpp applied in versions: 1.19.2-r2, 1.19.2-r3, 1.19.2-r4	21 Jul 202608:19	–	osv
OSV	CVE-2026-54696 Ruby JSON: JSON generator heap buffer overflow when streaming to an IO	30 Jun 202622:05	–	osv

Vulners

Node

json_project jsonRange2.9.0–2.19.9rubygems

Source	Link
github	www.github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-54696
github	www.github.com/ruby/json/commit/996bac686d64e4e3aaeae03b14a7f9ee9695ebdb
github	www.github.com/ruby/json/releases/tag/v2.19.9
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2026-54696.yml
github	www.github.com/advisories/GHSA-x2f5-4prf-w687

23 Jul 2026 19:48Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.13.7

EPSS0.00301

SSVC