---
id: CVE-2026-54696
title: >-
  json: Ruby JSON: Denial of service via heap buffer overflow with oversized
  streamed objects (CVE-2026-54696)
summary: >-
  A flaw was found in Ruby JSON. A remote attacker could exploit a heap buffer
  overflow vulnerability by providing an oversized streamed object containing a
  specially crafted string. This could lead to a reliable process crash,
  resulting in …
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: vendor
cwe:
  - CWE-787
  - CWE-122
  - CWE-131
vendor: Red Hat
product: Red Hat Hardened Images
affected:
  - 3scale_api_management_platform 2
  - amq_clients
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
  - openshift_dev_spaces
  - hardened_images
patched:
  - hardened_images
published: '2026-06-30'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T08:04:27+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54696.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54696.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-54696'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2495409'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-54696'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54696'
  - url: 'https://github.com/ruby/json/releases/tag/v2.19.9'
  - url: 'https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687'
  - url: 'https://access.redhat.com/errata/RHSA-2026:48482'
  - url: 'https://access.redhat.com/errata/RHSA-2026:47932'
  - url: >-
      https://github.com/ruby/json/commit/996bac686d64e4e3aaeae03b14a7f9ee9695ebdb
  - url: >-
      https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2026-54696.yml
  - url: 'https://github.com/advisories/GHSA-x2f5-4prf-w687'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - rubygems
epss: 0.00412
epssPercentile: 0.35218
aliases:
  - GHSA-x2f5-4prf-w687
ecosystem: rubygems
ingestedAt: '2026-07-23T20:19:19.455Z'
---

## Overview

A flaw was found in Ruby JSON. A remote attacker could exploit a heap buffer overflow vulnerability by providing an oversized streamed object containing a specially crafted string. This could lead to a reliable process crash, resulting in a denial of service (DoS) for the affected system.

## Vendor advisories

- **RHSA-2026:48482** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48482)
- **RHSA-2026:47932** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:47932)
- **Red Hat VEX** · Low · affected: Red Hat 3scale API Management Platform 2, Red Hat AMQ Clients, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Dev Spaces · no fix planned: Red Hat 3scale API Management Platform 2, Red Hat AMQ Clients, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54696.json)

**json: Ruby JSON: Denial of service via heap buffer overflow with oversized streamed objects** — rated Low by Red Hat. Released 2026-06-30, updated 2026-10-21.

Affected:

- Red Hat 3scale API Management Platform 2
- Red Hat AMQ Clients
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Dev Spaces

Fixed:

- Red Hat Hardened Images

No fix planned:

- Red Hat 3scale API Management Platform 2
- Red Hat AMQ Clients
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Dev Spaces

Not affected:

- Red Hat Hardened Images
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)

## Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:48482
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:47932

## Package advisory (CVE-2026-54696)

Affected packages:

- `json >= 2.9.0, < 2.19.9`

Patched in:

- `json 2.19.9`

Source: https://github.com/advisories/GHSA-x2f5-4prf-w687