p PatchFirst

CVE-2026-54696

CVE-2026-54696 · Ruby JSON: JSON generator heap buffer overflow when streaming to an IO

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.

CVSS 3.7 · Low · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • json

    Versions
    • >= 2.9.0, < 2.19.9: Affected

    No fix published

  • ruby-json Debian:13

    Versions
    • 2.15.2+dfsg-1
    • 2.18.1+dfsg-1
    • 2.19.1+dfsg-1
    • 2.19.2+dfsg-1
    • 2.19.4+dfsg-1
    • 2.19.9+dfsg-1
    • 2.21.1+dfsg-1
    • 2.21.2+dfsg-1
    • 2.9.1+dfsg-1
    • 3.0.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Debian:14

    Versions
    • 2.15.2+dfsg-1
    • 2.18.1+dfsg-1
    • 2.19.1+dfsg-1
    • 2.19.2+dfsg-1
    • 2.19.4+dfsg-1
    • 2.9.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 2.19.9+dfsg-1

    Update to 2.19.9+dfsg-1

  • jruby Ubuntu:Pro:14.04:LTS

    Versions
    • 1.5.6-5ubuntu1
    • 1.5.6-6
    • 1.5.6-7
    • 1.5.6-9+deb8u2build0.14.04.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:14.04:LTS

    Versions
    • 1.8.0-1
    • 1.8.0-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.3 Ubuntu:Pro:16.04:LTS

    Versions
    • 2.3.0-1
    • 2.3.0-2
    • 2.3.0-4ubuntu2
    • 2.3.0-4ubuntu3
    • 2.3.0-5ubuntu1
    • 2.3.1-2~16.04
    • 2.3.1-2~16.04.2
    • 2.3.1-2~16.04.4
    • 2.3.1-2~16.04.5
    • 2.3.1-2~16.04.6
    • 2.3.1-2~16.04.7
    • 2.3.1-2~16.04.9
    • 2.3.1-2~16.04.10
    • 2.3.1-2~16.04.11
    • 2.3.1-2~16.04.12
    • 2.3.1-2~ubuntu16.04.13
    • 2.3.1-2~ubuntu16.04.14
    • 2.3.1-2~ubuntu16.04.15
    • 2.3.1-2~ubuntu16.04.16
    • 2.3.1-2~ubuntu16.04.16+esm1
    • 2.3.1-2~ubuntu16.04.16+esm2
    • 2.3.1-2~ubuntu16.04.16+esm3
    • 2.3.1-2~ubuntu16.04.16+esm4
    • 2.3.1-2~ubuntu16.04.16+esm5
    • 2.3.1-2~ubuntu16.04.16+esm6
    • 2.3.1-2~ubuntu16.04.16+esm7
    • 2.3.1-2~ubuntu16.04.16+esm8
    • 2.3.1-2~ubuntu16.04.16+esm9
    • 2.3.1-2~ubuntu16.04.16+esm10
    • 2.3.1-2~ubuntu16.04.16+esm11
    • 2.3.1-2~ubuntu16.04.16+esm12
    • 2.3.1-2~ubuntu16.04.16+esm14
    • 2.3.1-2~ubuntu16.04.16+esm15
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jruby Ubuntu:16.04:LTS

    Versions
    • 1.7.21-2ubuntu4
    • 1.7.22-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:16.04:LTS

    Versions
    • 1.8.3-1build1
    • 1.8.3-1build2
    • 1.8.3-1build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.5 Ubuntu:Pro:18.04:LTS

    Versions
    • 2.5.0~preview1-1ubuntu2
    • 2.5.0-4ubuntu1
    • 2.5.0-4ubuntu4
    • 2.5.0-5ubuntu1
    • 2.5.0-6ubuntu1
    • 2.5.1-1ubuntu1
    • 2.5.1-1ubuntu1.1
    • 2.5.1-1ubuntu1.2
    • 2.5.1-1ubuntu1.4
    • 2.5.1-1ubuntu1.5
    • 2.5.1-1ubuntu1.6
    • 2.5.1-1ubuntu1.7
    • 2.5.1-1ubuntu1.8
    • 2.5.1-1ubuntu1.9
    • 2.5.1-1ubuntu1.10
    • 2.5.1-1ubuntu1.11
    • 2.5.1-1ubuntu1.12
    • 2.5.1-1ubuntu1.13
    • 2.5.1-1ubuntu1.14
    • 2.5.1-1ubuntu1.15
    • 2.5.1-1ubuntu1.16
    • 2.5.1-1ubuntu1.16+esm1
    • 2.5.1-1ubuntu1.16+esm3
    • 2.5.1-1ubuntu1.16+esm4
    • 2.5.1-1ubuntu1.16+esm5
    • 2.5.1-1ubuntu1.16+esm6
    • 2.5.1-1ubuntu1.16+esm7
    • 2.5.1-1ubuntu1.16+esm8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jruby Ubuntu:18.04:LTS

    Versions
    • 9.1.13.0-1
    • 9.1.17.0-1~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:18.04:LTS

    Versions
    • 2.1.0+dfsg-1
    • 2.1.0+dfsg-1ubuntu2
    • 2.1.0+dfsg-1ubuntu3
    • 2.1.0+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby2.7 Ubuntu:Pro:20.04:LTS

    Versions
    • 2.7.0-1
    • 2.7.0-2
    • 2.7.0-3
    • 2.7.0-4
    • 2.7.0-4ubuntu1
    • 2.7.0-5ubuntu1
    • 2.7.0-5ubuntu1.1
    • 2.7.0-5ubuntu1.2
    • 2.7.0-5ubuntu1.3
    • 2.7.0-5ubuntu1.4
    • 2.7.0-5ubuntu1.5
    • 2.7.0-5ubuntu1.6
    • 2.7.0-5ubuntu1.7
    • 2.7.0-5ubuntu1.8
    • 2.7.0-5ubuntu1.9
    • 2.7.0-5ubuntu1.10
    • 2.7.0-5ubuntu1.11
    • 2.7.0-5ubuntu1.12
    • 2.7.0-5ubuntu1.13
    • 2.7.0-5ubuntu1.14
    • 2.7.0-5ubuntu1.15
    • 2.7.0-5ubuntu1.16
    • 2.7.0-5ubuntu1.17
    • 2.7.0-5ubuntu1.18
    • 2.7.0-5ubuntu1.18+esm1
    • 2.7.0-5ubuntu1.18+esm3
    • 2.7.0-5ubuntu1.18+esm4
    • 2.7.0-5ubuntu1.18+esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jruby Ubuntu:20.04:LTS

    Versions
    • 9.1.17.0-3
    • 9.1.17.0-3build5
    • 9.1.17.0-3build6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:20.04:LTS

    Versions
    • 2.1.0+dfsg-2
    • 2.3.0+dfsg-1
    • 2.3.0+dfsg-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:22.04:LTS

    Versions
    • 2.3.0+dfsg-1build1
    • 2.5.1+dfsg-2
    • 2.5.1+dfsg-2build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.0 Ubuntu:22.04:LTS

    Versions
    • 3.0.2-5ubuntu1
    • 3.0.2-7
    • 3.0.2-7ubuntu2
    • 3.0.2-7ubuntu2.1
    • 3.0.2-7ubuntu2.2
    • 3.0.2-7ubuntu2.3
    • 3.0.2-7ubuntu2.4
    • 3.0.2-7ubuntu2.5
    • 3.0.2-7ubuntu2.6
    • 3.0.2-7ubuntu2.7
    • 3.0.2-7ubuntu2.8
    • 3.0.2-7ubuntu2.10
    • 3.0.2-7ubuntu2.11
    • 3.0.2-7ubuntu2.12
    • 3.0.2-7ubuntu2.13
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jruby Ubuntu:24.04:LTS

    Versions
    • 9.3.9.0+ds-1
    • 9.4.5.0+ds-1
    • 9.4.5.0+ds-1ubuntu1
    • 9.4.6.0+ds-1ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:24.04:LTS

    Versions
    • 2.6.3+dfsg-1build2
    • 2.6.3+dfsg-1build3
    • 2.6.3+dfsg-1build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.2 Ubuntu:24.04:LTS

    Versions
    • 3.2.3-1
    • 3.2.3-1build2
    • 3.2.3-1build3
    • 3.2.3-1ubuntu0.24.04.1
    • 3.2.3-1ubuntu0.24.04.3
    • 3.2.3-1ubuntu0.24.04.5
    • 3.2.3-1ubuntu0.24.04.6
    • 3.2.3-1ubuntu0.24.04.7
    • 3.2.3-1ubuntu0.24.04.8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jruby Ubuntu:25.10

    Versions
    • 9.4.8.0+ds-2ubuntu1
    • 9.4.8.0+ds-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:25.10

    Versions
    • 2.9.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby3.3 Ubuntu:25.10

    Versions
    • 3.3.7-1ubuntu2
    • 3.3.8-2ubuntu1
    • 3.3.8-2ubuntu2
    • 3.3.8-2ubuntu2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jruby Ubuntu:26.10

    Versions
    • 9.4.8.0+ds-3ubuntu1
    • 9.4.14.0+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:26.10

    Versions
    • 2.18.1+dfsg-1
    • 2.21.1+dfsg-1
    • 2.21.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →