CVE-2026-54696Low· 3.7▾ SunlitA flaw was found in Ruby JSON. A remote attacker could exploit a heap buffer overflow vulnerability by providing an oversized streamed object containing a specially crafted string. This could lead to a reliable process crash, resulting in …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
Last analysed / modified upstream
0.3% → 0.4%
A flaw was found in Ruby JSON. A remote attacker could exploit a heap buffer overflow vulnerability by providing an oversized streamed object containing a specially crafted string. This could lead to a reliable process crash, resulting in a denial of service (DoS) for the affected system.
json: Ruby JSON: Denial of service via heap buffer overflow with oversized streamed objects — rated Low by Red Hat. Released 2026-06-30, updated 2026-10-21.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:48482 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:47932
Affected packages:
json >= 2.9.0, < 2.19.9Patched in:
json 2.19.9Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116124High· 7.8libgsf: libgsf: Arbitrary code execution via heap-based buffer overflow in OLE2 parser (CVE-2026-116124)
CVE-2026-116160Low· 3.3ImageMagick: ImageMagick: Denial of Service via crafted image in X11 animate operation (CVE-2026-116160)
CVE-2026-85746High· 8.8mariadb: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections (CVE-2026-85746)
CVE-2026-55893High· 7.0Capstone is a disassembly framework
CVE-2026-39113Medium· 4.0Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11…
CVE-2026-116149High· 7.8ImageMagick: ImageMagick: Memory corruption via crafted bzip2 compressed images (CVE-2026-116149)