CVE-2026-54696

Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.

• CWE-122
• CWE-131
• CWE-787

• https://github.com/ruby/json/releases/tag/v2.19.9
• https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687
• https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687

Published

Jun 30, 2026

Last Modified

Jul 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54686Warp is an agentic development environment. From 0.2021.04.2…4.3
• CVE-2026-5469A weakness has been identified in Casdoor 2.356.0. This vuln…7.2
• CVE-2026-54690datamodel-code-generator generates Pydantic v2 models, datac…8.2
• CVE-2026-54691datamodel-code-generator generates Python data models from s…8.2
• CVE-2026-54693ZITADEL is an open source identity management platform. From…8.2
• CVE-2026-54695Pipecat is an open-source Python framework for building real…6.5
• CVE-2026-54698Hasura is an open-source product that provides users GraphQL…6
• CVE-2026-54699Warp is an agentic development environment. From 0.2024.03.1…7.7
• CVE-2026-5470A security vulnerability has been detected in mixelpixx Goog…6.3
• CVE-2026-54704OpenTelemetry Java Instrumentation provides OpenTelemetry au…6.5
• CVE-2026-54705MathLive provides web components for math display and input.…6.3
• CVE-2026-54706OnionShare is an open source tool that lets you securely and…4.8