CVE-2026-54696 Ruby JSON: JSON generator heap buffer overflow when streaming to an IO
An attacker can cause a denial of service via heap buffer overflow in the Ruby JSON library when streaming oversized objects to an IO.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54696?
CVE-2026-54696 is a low-severity memory corruption vulnerability in ruby json, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.
Which versions are affected by CVE-2026-54696?
2 open source packages ship an affected version, including json.
| Package | Affected | Fixed in |
|---|---|---|
json RubyGems | From 2.9.0 | 2.19.9 |
json RubyGems | From 2.9.0 | 2.19.9 |
Linux distribution packages (30)
ruby3.4 Red Hat:hummingbird:1 | All versions | 0:3.4.10-31.5.hum1 |
ruby3.4-bundled-gems Red Hat:hummingbird:1 | All versions | 0:3.4.10-31.5.hum1 |
ruby3.4-default-gems Red Hat:hummingbird:1 | All versions | 0:3.4.10-31.5.hum1 |
ruby3.4-devel Red Hat:hummingbird:1 | All versions | 0:3.4.10-31.5.hum1 |
ruby3.4-doc Red Hat:hummingbird:1 | All versions | 0:3.4.10-31.5.hum1 |
ruby3.4-libs Red Hat:hummingbird:1 | All versions | 0:3.4.10-31.5.hum1 |
ruby4.0 Red Hat:hummingbird:1 | All versions | 0:4.0.6-37.1.hum1 |
ruby4.0-bundled-gems Red Hat:hummingbird:1 | All versions | 0:4.0.6-37.1.hum1 |
ruby4.0-default-gems Red Hat:hummingbird:1 | All versions | 0:4.0.6-37.1.hum1 |
ruby4.0-devel Red Hat:hummingbird:1 | All versions | 0:4.0.6-37.1.hum1 |
ruby4.0-doc Red Hat:hummingbird:1 | All versions | 0:4.0.6-37.1.hum1 |
ruby4.0-libs Red Hat:hummingbird:1 | All versions | 0:4.0.6-37.1.hum1 |
rubygem4.0-bigdecimal Red Hat:hummingbird:1 | All versions | 0:4.0.1-37.1.hum1 |
rubygem4.0-bundler Red Hat:hummingbird:1 | All versions | 0:4.0.16-37.1.hum1 |
rubygem4.0-devel Red Hat:hummingbird:1 | All versions | 0:4.0.16-37.1.hum1 |
rubygem4.0-io-console Red Hat:hummingbird:1 | All versions | 0:0.8.2-37.1.hum1 |
rubygem4.0-irb Red Hat:hummingbird:1 | All versions | 0:1.16.0-37.1.hum1 |
rubygem4.0-json Red Hat:hummingbird:1 | All versions | 0:2.18.0-37.1.hum1 |
rubygem4.0-minitest Red Hat:hummingbird:1 | All versions | 0:6.0.0-37.1.hum1 |
rubygem4.0-power_assert Red Hat:hummingbird:1 | All versions | 0:3.0.1-37.1.hum1 |
rubygem4.0-psych Red Hat:hummingbird:1 | All versions | 0:5.3.1-37.1.hum1 |
rubygem4.0-racc Red Hat:hummingbird:1 | All versions | 0:1.8.1-37.1.hum1 |
rubygem4.0-rake Red Hat:hummingbird:1 | All versions | 0:13.3.1-37.1.hum1 |
rubygem4.0-rbs Red Hat:hummingbird:1 | All versions | 0:3.10.0-37.1.hum1 |
rubygem4.0-rdoc Red Hat:hummingbird:1 | All versions | 0:7.0.4-37.1.hum1 |
rubygem4.0-rexml Red Hat:hummingbird:1 | All versions | 0:3.4.4-37.1.hum1 |
rubygem4.0-rss Red Hat:hummingbird:1 | All versions | 0:0.3.2-37.1.hum1 |
rubygem4.0-rubygems Red Hat:hummingbird:1 | All versions | 0:4.0.16-37.1.hum1 |
rubygem4.0-test-unit Red Hat:hummingbird:1 | All versions | 0:3.7.5-37.1.hum1 |
rubygem4.0-typeprof Red Hat:hummingbird:1 | All versions | 0:0.31.1-37.1.hum1 |
How do I fix CVE-2026-54696?
Upgrade json to 2.19.9 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-54696 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54696 exists.
Sources
Also known as CLEANSTART-2026-DL54302, CLEANSTART-2026-EH26005, CLEANSTART-2026-KE67009, DEBIAN-CVE-2026-54696, GHSA-x2f5-4prf-w687, MINI-2779-v898-xxgx and 29 more.