CVE-2026-54696

What it actually does

Ruby JSON versions 2.9.0 through 2.19.8 contain a heap buffer overflow in the JSON generation path used when streaming output to an IO object. If JSON.dump(obj, io) or JSON::State#generate(obj, io) serializes an attacker-influenced object containing a string near 16 KB, the generator can write past its internal buffer. The documented impact is a reliable crash of the Ruby process, resulting in denial of service; confidentiality and integrity impact are not indicated by the advisory.

Why it matters to the business

Applications and services that accept user-controlled data and serialize it to streamed JSON output may be vulnerable to remote or unauthenticated service crashes, depending on how the application exposes JSON generation. The practical risk is service disruption, worker restarts, failed API requests, degraded availability, and possible cascading impact in job processors or web services that repeatedly process malicious input. The issue is not currently listed in CISA KEV, has low EPSS, and has no known public exploit maturity in the provided data, but it should still be remediated where Ruby JSON 2.9.0 through 2.19.8 is present because exploitation can be reliable once a reachable code path is identified.

How an attack unfolds

An attacker first identifies an application feature that accepts input later serialized with the Ruby JSON library while streaming to an IO object rather than generating JSON only in memory. The attacker then submits or causes processing of a crafted object containing an attacker-controlled string around the vulnerable size boundary near 16 KB. When the application invokes JSON.dump(obj, io) or JSON::State#generate(obj, io), the JSON generator mishandles the streamed object and writes beyond its internal heap buffer. The expected outcome is a crash of the Ruby process handling the request or job. Repeated submissions can cause recurring denial of service, especially in web workers, background processors, or API endpoints that automatically restart after a crash.

How to fix it

Upgrade the Ruby JSON gem to version 2.19.9 or later. If the gem is managed through Bundler, update the dependency constraint and regenerate the lockfile so deployments resolve to a fixed version. If JSON is packaged through the Ruby runtime or operating-system packages, apply the vendor-provided patched package when available. Where immediate upgrade is not possible, reduce exposure by avoiding streamed JSON generation for attacker-controlled objects, validating or limiting maximum string sizes before serialization, rate-limiting relevant endpoints, and isolating worker processes so repeated crashes do not affect unrelated application functions. These mitigations reduce risk but should not replace upgrading to a fixed version.

How to confirm the fix worked

Confirm that all deployed Ruby applications and images resolve the json gem to version 2.19.9 or later. Check Gemfile.lock, gem inventory, container image SBOMs, and runtime output such as `bundle exec ruby -rjson -e 'puts JSON::VERSION'` where appropriate. Review application code for use of JSON.dump(obj, io) and JSON::State#generate(obj, io), especially when object contents may include user-supplied strings. After upgrading, run regression tests that serialize large strings to streamed IO outputs and confirm the process remains stable. Also verify that deployed artifacts were rebuilt and restarted so no old vulnerable gem versions remain loaded in long-running processes.

Typical attack path

1. Identify a Ruby application or service using the json gem in versions 2.9.0 through 2.19.8.
2. Find an input path where attacker-controlled data is serialized to JSON using streaming IO generation.
3. Craft input that causes a string near 16 KB to be included in the object being serialized.
4. Trigger JSON.dump(obj, io) or JSON::State#generate(obj, io) on that object.
5. Cause the Ruby process to crash due to heap buffer overflow.
6. Repeat the request or job submission to sustain application-level denial of service.

How to detect it

To determine whether exploitation has already occurred, review application logs, web access logs, process supervisor logs, container restart events, crash dumps, and host kernel logs for Ruby process crashes correlated with requests or jobs containing large string fields near 16 KB. Focus on services that generate streamed JSON responses or files. Look for sudden bursts of HTTP 500/502/503 responses, worker exits, container CrashLoopBackOff events, segmentation faults, abnormal terminations, or allocator corruption messages involving Ruby processes. Correlate crashes with client IPs, request paths, payload sizes, user agents, job identifiers, and repeated retries. If core dumps are available, inspect stack traces for Ruby JSON generation functions, JSON.dump, JSON::State#generate, or native json extension frames. Absence of these artifacts does not prove non-exploitation, because a successful denial-of-service attempt may only appear as a generic crash or restart.

• JSON.dump
• JSON::State#generate
• JSON::VERSION
• json-2.9.0
• json-2.19.8
• json-2.19.9
• segfault at
• Segmentation fault
• core dumped
• ruby: [BUG] Segmentation fault
• ruby: [BUG]
• malloc(): corrupted top size
• malloc(): invalid size
• free(): invalid pointer
• double free or corruption
• Aborted (core dumped)
• CrashLoopBackOff
• OOMKilled
• signal SIGSEGV
• signal SIGABRT

What your security team should do

• Inventory Ruby applications, containers, and packaged services for json gem versions 2.9.0 through 2.19.8.
• Prioritize patching internet-facing APIs, webhook handlers, file import services, and background workers that serialize user-controlled content to streamed JSON.
• Upgrade to json 2.19.9 or later and redeploy all affected services.
• Search code repositories for JSON.dump calls with an IO argument and JSON::State#generate calls that stream to IO.
• Add temporary input-size limits and request throttling on routes that can carry large attacker-controlled strings until upgrades are complete.
• Monitor application supervisors, container orchestrators, and host logs for Ruby process crashes, segmentation faults, or repeated worker restarts.
• Create a focused denial-of-service detection rule for repeated requests containing approximately 16 KB string fields followed by Ruby process crashes or 5xx spikes.
• Track vendor package updates if Ruby JSON is supplied by an OS distribution or runtime image rather than directly through Bundler.