DEBIAN-CVE-2026-54696

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-54696

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-54696.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-54696

Upstream

CVE-2026-54696

Published

2026-06-30T23:17:28Z

Modified

2026-08-27T23:06:16Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

[none]

Details

Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.

References

https://security-tracker.debian.org/tracker/CVE-2026-54696

Affected packages

Debian:13 / ruby-json

Package

Name: ruby-json
Purl: pkg:deb/debian/ruby-json?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.9.1+dfsg-1

2.15.2+dfsg-1

2.18.1+dfsg-1

2.19.1+dfsg-1

2.19.2+dfsg-1

2.19.4+dfsg-1

2.19.9+dfsg-1

2.21.1+dfsg-1

2.21.2+dfsg-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-54696.json"

Debian:14 / ruby-json