DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54696: CVE-2026-54696: Heap-based Buffer Overflow in Ruby json Gem Native C Extension

#security #cve #cybersecurity

CVE-2026-54696: Heap-based Buffer Overflow in Ruby json Gem Native C Extension

Vulnerability ID: CVE-2026-54696
CVSS Score: 3.7
Published: 2026-07-23

A heap-based buffer overflow vulnerability exists in the native C extension of the Ruby json gem (versions 2.9.0 through 2.19.8) during IO-based streaming serialization. An incorrect buffer size calculation can lead to memory corruption and process termination when processing large strings.

TL;DR

A dynamic buffer capacity calculation error in the Ruby json gem's C extension allows attackers to trigger a heap-based buffer overflow and crash the application by sending strings close to 16 KB during IO-based streaming serialization.

Technical Details

  • CWE ID: CWE-122
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 3.7
  • EPSS Score: 0.00301 (22.29th percentile)
  • Impact: Low (Denial of Service via process crash)
  • Exploit Status: None
  • KEV Status: Not Listed

Affected Systems

  • Ruby application environments running json gem version 2.9.0 up to 2.19.8
  • Operating system packages hosting pre-packaged native Ruby JSON libraries within the affected version ranges
  • json gem: >= 2.9.0, <= 2.19.8 (Fixed in: 2.19.9)

Code Analysis

Commit: 996bac6

Fix heap-based buffer overflow in FBuffer during IO streaming

Mitigation Strategies

  • Upgrade to ruby json gem version 2.19.9 or later
  • Avoid direct streaming to IO objects (e.g. JSON.dump with an IO argument) when handling untrusted inputs of size close to 16 KB
  • Generate the JSON string in memory first (e.g. via JSON.fast_generate) and then write to the IO object

Remediation Steps:

  1. Open your application Gemfile and update the json dependency entry to: gem 'json', '>= 2.19.9'
  2. Run 'bundle update json' to apply the update in your bundle lockfile
  3. Verify the installed gem version using 'gem list json' or 'bundle info json'
  4. Restart application servers and worker pools to load the patched C extension into memory

References

Read the full report for CVE-2026-54696 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)