CVE-2026-54696: Ruby JSON Heap Buffer Overflow DoS Flaw

CVE-2026-54696 Overview

CVE-2026-54696 is a heap buffer overflow [CWE-122] in the Ruby JSON library. Versions 2.9.0 through 2.19.8 are affected. The flaw resides in the streaming generator path used by JSON.dump(obj, io) and JSON::State#generate(obj, io). When a streamed object contains an attacker-controlled string near 16 KB, the generator writes past its internal buffer. Successful exploitation results in a reliable process crash and denial of service. Version 2.19.9 contains the fix.

Critical Impact
Attackers who can influence strings passed to the streaming JSON generator can trigger a reliable process crash, causing denial of service in Ruby applications that serialize untrusted data.

Affected Products

Ruby JSON gem versions 2.9.0 through 2.19.8
Applications calling JSON.dump(obj, io) with untrusted input
Applications using JSON::State#generate(obj, io) for streamed serialization

Discovery Timeline

2026-06-30 - CVE-2026-54696 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-54696

Vulnerability Analysis

The Ruby JSON library provides a streaming interface that writes generated JSON directly to an IO object rather than accumulating the full result in memory. This streaming path maintains an internal buffer used to stage bytes before flushing to the destination IO.

The defect occurs when a streamed object contains a string of approximately 16 KB. Under this specific size condition, the generator writes past the end of its internal buffer on the heap. The out-of-bounds write corrupts adjacent heap memory and reliably crashes the Ruby process.

The issue is classified as heap-based buffer overflow [CWE-122]. Impact is limited to availability. The advisory describes the outcome as a reliable process crash and denial of service, not memory disclosure or code execution.

Root Cause

The root cause is incorrect buffer size handling in the streaming generator when the current chunk being written approaches the flush boundary near 16 KB. The generator fails to correctly bound the copy operation against the remaining capacity of its internal buffer before writing string content, resulting in a write past the allocated region.

Attack Vector

Exploitation requires an attacker to control a string value that is serialized through the streaming JSON generator. Any Ruby service that accepts external input and later serializes it with JSON.dump(obj, io) or JSON::State#generate(obj, io) is a candidate target. The attacker submits a payload containing a string sized close to 16 KB and forces the target to serialize the object to an IO stream. The resulting overflow crashes the worker process. See the GitHub Security Advisory GHSA-x2f5-4prf-w687 for technical details.

Detection Methods for CVE-2026-54696

Indicators of Compromise

Repeated unexpected termination of Ruby worker processes handling JSON serialization
Segmentation faults or SIGABRT signals originating from the json C extension in application logs
HTTP request bodies or API payloads containing string fields near 16384 bytes in size directed at endpoints known to invoke JSON.dump with an IO argument

Detection Strategies

Inventory installed json gem versions across Ruby applications and flag any release between 2.9.0 and 2.19.8
Perform static analysis for call sites of JSON.dump(obj, io) and JSON::State#generate(obj, io) that receive untrusted data
Correlate application crashes with recent request payloads to identify malicious oversized string inputs

Monitoring Recommendations

Alert on abnormal rates of Ruby process restarts, worker crashes, or supervisor respawn events
Track request payload sizes and specifically flag JSON fields containing strings between 15 KB and 17 KB targeting serialization endpoints
Monitor error telemetry for stack traces referencing generator.c or the JSON native extension

How to Mitigate CVE-2026-54696

Immediate Actions Required

Upgrade the json gem to version 2.19.9 or later across all Ruby applications
Audit application code for calls to JSON.dump(obj, io) and JSON::State#generate(obj, io) that process external input
Rebuild and redeploy container images that bundle the vulnerable json gem

Patch Information

The issue is fixed in Ruby JSON version 2.19.9. Update the gem via bundle update json or by pinning gem 'json', '>= 2.19.9' in the Gemfile. Release notes are available in the GitHub Release v2.19.9.

Workarounds

Avoid the streaming form of the generator by calling JSON.dump(obj) or JSON.generate(obj) without an IO argument until the gem is upgraded
Enforce input size limits at the application or reverse-proxy layer to reject string fields larger than a few kilobytes when serialization is required
Wrap serialization calls in supervised workers so a crash does not disrupt the parent service

bash

# Upgrade the vulnerable json gem
bundle update json

# Verify the installed version is 2.19.9 or later
ruby -rjson -e 'puts JSON::VERSION'