Summary
Ruby json: JSON generator heap buffer overflow when streaming to an IO
JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the
internal JSON generator buffer when a streamed object contains an
attacker-controlled string near 16 KB. The issue is a heap out-of-bounds write
in the IO-streaming path and is demonstrated as a reliable process crash /
denial of service.
This was triaged on HackerOne as report #3785370. The issue was confirmed there
and I was asked to open it here.
Details
Root cause is in ext/json/fbuffer/fbuffer.h, fbuffer_do_inc_capa().
On the IO path, the buffer is grown to FBUFFER_IO_BUFFER_SIZE (16383), but the
early return checks total capacity instead of remaining capacity:
if (RB_UNLIKELY(fb->io)) {
if (fb->capa < FBUFFER_IO_BUFFER_SIZE) {
fbuffer_realloc(fb, FBUFFER_IO_BUFFER_SIZE);
} else {
fbuffer_flush(fb);
}
if (RB_LIKELY(requested < fb->capa)) {
return;
}
}
If fb->len already contains JSON syntax bytes, and a string flush has16383 - fb->len <= requested < 16383, this check returns even though there is
not enough space left. fbuffer_append_reserved() then writes past the buffer:
MEMCPY(fb->ptr + fb->len, newstr, char, len);
The minimal fix is to compare against the remaining capacity:
- if (RB_LIKELY(requested < fb->capa)) {
+ if (RB_LIKELY(requested <= fb->capa - fb->len)) {
return;
}
PoC
require "json"
require "stringio"
io = StringIO.new
big = "a" * 16385
big[16382] = '"' # escapable byte near the buffer boundary
JSON.dump([big], io)
Verified results:
Ruby 4.0.5 / bundled json 2.18.0:
malloc(): invalid size (unsorted)
.../json/common.rb:956: [BUG] Aborted
ruby/ruby master c78418b7a0 / json 2.19.8 / ASan:
heap-buffer-overflow WRITE of size 16382
fbuffer_append_reserved ext/json/fbuffer/fbuffer.h:145
search_flush ext/json/generator/generator.c:139
convert_UTF8_to_JSON ext/json/generator/generator.c:231
raw_generate_json_string ext/json/generator/generator.c:922
cState_m_generate ext/json/generator/generator.c:1891
Control: the same data through JSON.dump([big]) without an IO argument returns
normally. The bug is specific to the IO-streaming path.
Impact
A remote attacker can trigger a heap out-of-bounds write if they control a
string field that an application serializes through JSON.dump(obj, io) orJSON::State#generate(obj, io). The demonstrated impact is reliable denial of
service. I am not claiming code execution or information disclosure.
A write operation targets a memory location beyond the intended buffer boundary. Typical impact: memory corruption, crash, or arbitrary code execution.
CVE-2026-54696 has a CVSS score of 3.7 (Low). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.19.9); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-54696? CVE-2026-54696 is a low-severity out-of-bounds write vulnerability in json (rubygems), affecting versions >= 2.9.0, < 2.19.9. It is fixed in 2.19.9. A write operation targets a memory location beyond the intended buffer boundary.
- How severe is CVE-2026-54696? CVE-2026-54696 has a CVSS score of 3.7 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of json are affected by CVE-2026-54696? json (rubygems) versions >= 2.9.0, < 2.19.9 is affected.
- Is there a fix for CVE-2026-54696? Yes. CVE-2026-54696 is fixed in 2.19.9. Upgrade to this version or later.
- Is CVE-2026-54696 exploitable, and should I be worried? Whether CVE-2026-54696 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-54696 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-54696? Upgrade
jsonto 2.19.9 or later.