CVE-2026-54696

lowCVSS 3.7covered by 1 sourcefirst seen 2026-06-30

Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.

⚡ Watch CVE-2026-54696

Get an email if CVE-2026-54696 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.

Advisory coverage (1)

lowCVE-2026-54696: Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to h…nvd · 2026-06-30

External references

NVD record for CVE-2026-54696

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-54696 status](https://www.csirts.com/badge/CVE-2026-54696)](https://www.csirts.com/cve/CVE-2026-54696)