{"id":"CVE-2026-54696","aliases":["GHSA-x2f5-4prf-w687"],"title":"Ruby json: JSON generator heap buffer overflow when streaming to an IO","summary":"Ruby json: JSON generator heap buffer overflow when streaming to an IO","severity":"low","cvss":3.7,"cwe":["CWE-122","CWE-131","CWE-787"],"vendor":"json","product":"json","ecosystem":"rubygems","affected":["json >= 2.9.0, < 2.19.9"],"patched":["json 2.19.9"],"published":"2026-07-23","updated":"2026-07-23","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-x2f5-4prf-w687","references":[{"url":"https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54696"},{"url":"https://github.com/ruby/json/commit/996bac686d64e4e3aaeae03b14a7f9ee9695ebdb"},{"url":"https://github.com/ruby/json/releases/tag/v2.19.9"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2026-54696.yml"},{"url":"https://github.com/advisories/GHSA-x2f5-4prf-w687"}],"tags":["ghsa","rubygems"],"epss":0.00382,"epssPercentile":0.32097,"ingestedAt":"2026-07-23T20:19:19.455Z","slug":"CVE-2026-54696","body":"## Overview\n\n### Summary\n\n`JSON.dump(obj, io)` and `JSON::State#generate(obj, io)` can write past the\ninternal JSON generator buffer when a streamed object contains an\nattacker-controlled string near 16 KB. The issue is a heap out-of-bounds write\nin the IO-streaming path and is demonstrated as a reliable process crash /\ndenial of service.\n\nThis was triaged on HackerOne as report #3785370. The issue was confirmed there\nand I was asked to open it here.\n\n### Details\n\nRoot cause is in `ext/json/fbuffer/fbuffer.h`, `fbuffer_do_inc_capa()`.\n\nOn the IO path, the buffer is grown to `FBUFFER_IO_BUFFER_SIZE` (16383), but the\nearly return checks total capacity instead of remaining capacity:\n\n```c\nif (RB_UNLIKELY(fb->io)) {\n    if (fb->capa < FBUFFER_IO_BUFFER_SIZE) {\n        fbuffer_realloc(fb, FBUFFER_IO_BUFFER_SIZE);\n    } else {\n        fbuffer_flush(fb);\n    }\n\n    if (RB_LIKELY(requested < fb->capa)) {\n        return;\n    }\n}\n```\n\nIf `fb->len` already contains JSON syntax bytes, and a string flush has\n`16383 - fb->len <= requested < 16383`, this check returns even though there is\nnot enough space left. `fbuffer_append_reserved()` then writes past the buffer:\n\n```c\nMEMCPY(fb->ptr + fb->len, newstr, char, len);\n```\n\nThe minimal fix is to compare against the remaining capacity:\n\n```diff\n-        if (RB_LIKELY(requested < fb->capa)) {\n+        if (RB_LIKELY(requested <= fb->capa - fb->len)) {\n             return;\n         }\n```\n\n### PoC\n\n```ruby\nrequire \"json\"\nrequire \"stringio\"\n\nio = StringIO.new\nbig = \"a\" * 16385\nbig[16382] = '\"'          # escapable byte near the buffer boundary\n\nJSON.dump([big], io)\n```\n\nVerified results:\n\n```text\nRuby 4.0.5 / bundled json 2.18.0:\nmalloc(): invalid size (unsorted)\n.../json/common.rb:956: [BUG] Aborted\n\nruby/ruby master c78418b7a0 / json 2.19.8 / ASan:\nheap-buffer-overflow WRITE of size 16382\n  fbuffer_append_reserved  ext/json/fbuffer/fbuffer.h:145\n  search_flush             ext/json/generator/generator.c:139\n  convert_UTF8_to_JSON     ext/json/generator/generator.c:231\n  raw_generate_json_string ext/json/generator/generator.c:922\n  cState_m_generate        ext/json/generator/generator.c:1891\n```\n\nControl: the same data through `JSON.dump([big])` without an IO argument returns\nnormally. The bug is specific to the IO-streaming path.\n\n### Impact\n\nA remote attacker can trigger a heap out-of-bounds write if they control a\nstring field that an application serializes through `JSON.dump(obj, io)` or\n`JSON::State#generate(obj, io)`. The demonstrated impact is reliable denial of\nservice. I am not claiming code execution or information disclosure.\n\n## Affected packages\n\n- `json >= 2.9.0, < 2.19.9`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `json 2.19.9`","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}