CVE-2026-54696: Ruby JSON Heap Buffer Overflow – DoS via Stream Generator

Technical summary

The vulnerability exists in Ruby JSON's streaming generator mechanism (JSON.dump with IO targets and JSON::State#generate). When serializing objects to an output stream, the generator allocates an internal buffer for intermediate data. The flaw allows an attacker-controlled string near the 16 KB boundary to trigger a write past the allocated buffer bounds, resulting in heap corruption. The issue stems from inadequate bounds checking between the buffer size and the data being serialized. This affects CWE-122 (Heap-based Buffer Overflow), CWE-131 (Incorrect Calculation of Buffer Size), and CWE-787 (Out-of-Bounds Write). The overflow is reliable and consistently causes process termination.

Business impact

The primary impact is availability disruption. Applications using affected Ruby JSON versions to process untrusted JSON data or objects may experience unexpected crashes or service interruption. For services that rely on background JSON processing, batch jobs, or API endpoints that serialize large objects, this could result in dropped requests or failed operations. The risk is elevated in multi-tenant or user-facing systems where attackers can submit crafted input. However, because there is no data exfiltration or system compromise, the business damage is limited to service degradation rather than data breach or privilege escalation.

Affected systems

Ruby JSON library versions 2.9.0 through 2.19.8 are affected. Any application or service using these versions that accepts or processes untrusted objects for JSON serialization to a stream (file, network socket, or buffer) is at risk. This includes Ruby on Rails applications, microservices, API servers, and batch processors that use the standard json gem. Applications must verify their exact Ruby JSON version; the vulnerability does not affect Ruby itself or other JSON libraries unless they rely on the Ruby JSON gem as a dependency.

Exploitability

Exploitation requires two preconditions: (1) the application must use JSON.dump or JSON::State#generate with an IO target for streaming, and (2) the attacker must be able to supply or influence the object being serialized, specifically injecting a string near the 16 KB size threshold. The CVSS vector reflects high complexity (AC:H), indicating that while the technical mechanism is straightforward, the practical attack surface depends on how applications expose JSON generation to untrusted input. No known public exploits exist, and the vulnerability is not currently tracked on CISA's KEV catalog. The barrier to exploitation is moderate for networked services that accept JSON payloads or user-supplied data objects.

Remediation

Upgrade Ruby JSON to version 2.19.9 or later. This is a straightforward dependency update for most applications. Verify the upgrade in your Gemfile or gemspec, run bundle update json, and redeploy. For applications unable to upgrade immediately, implement input validation and size limits on incoming objects before JSON serialization, particularly capping string lengths to prevent near-16 KB anomalies. Monitor application logs for unexpected crashes correlated with JSON serialization operations.

Patch guidance

Update the Ruby JSON gem to version 2.19.9 or any subsequent release. Consult the official Ruby JSON repository and release notes to confirm patch availability for your target version. Test the upgrade in a staging environment to ensure compatibility with your application's JSON processing workflows. If you maintain pinned dependencies, update your lock files and re-run your test suite. For containerized deployments, rebuild images with the patched gem version and redeploy. There are no known breaking changes in 2.19.9 relative to earlier 2.19.x versions.

Detection guidance

Monitor application error logs and crash dumps for segmentation faults or heap corruption errors originating from the json gem, particularly during JSON serialization operations. Track Ruby JSON version across your infrastructure using software inventory tools or package managers. In production environments, enable core dumps and heap sanitizer logs (ASAN) in development/staging to detect heap violations. Network-level detection is impractical since the trigger is internal to JSON processing; focus on endpoint health monitoring and request pattern analysis for anomalous serialization payloads (unusually large strings in JSON objects).

Why prioritize this

This vulnerability merits prompt but not emergency patching. Although the CVSS score is low (3.7) and no ransomware link exists, the reliable denial-of-service impact and broad use of the Ruby JSON gem in production systems mean that widespread adoption of version 2.19.9 is prudent. Prioritize patching for public-facing APIs, multi-tenant platforms, and critical batch processing services that accept user input. Lower-priority patches can be batched with routine updates for internal tools or systems with restricted input sources.

Risk score, explained

The CVSS 3.1 score of 3.7 (LOW) reflects a network-exploitable vulnerability (AV:N) with high attack complexity (AC:H) that impacts only availability (A:L). No confidentiality or integrity impact is possible since the overflow crashes the process rather than enabling code execution or data leakage. The high complexity factor accounts for the requirement to craft a specific object structure with a precisely-sized string component. While the impact scope is user-initiated service disruption rather than system-wide compromise, the ease of reproduction once the conditions are met justifies the non-zero score.

Frequently asked questions